\\n>

⚙️ Run configuration

\\n> \\n> **Configuration used**: Organization UI\\n> \\n> **Review profile**: ASSERTIVE\\n> \\n> **Plan**: Pro\\n> \\n> **Run ID**: `d7341a97-9596-41e8-9b7b-c8ab8fd80e15`\\n> \\n>

\\n> \\n>

\\n>

📥 Commits

\\n> \\n> Reviewing files that changed from the base of the PR and between 7aafe0c052bdd26913b44c1cb9c65f1c7c2f73ec and ca19915713018576089f4d9c44ed32a2c79d902f.\\n> \\n>

\\n> \\n>

\\n>

📒 Files selected for processing (5)

\\n> \\n> * `.github/workflows/auto-release-tag.yml`\\n> * `.github/workflows/release.yml`\\n> * `docs/topics/release-process/policy.toml`\\n> * `docs/topics/release-process/runbook.md`\\n> * `xtask/src/main.rs`\\n> \\n>

\\n> \\n> ```ascii\\n> _______________________________________\\n> < `NaN` is not a valid user experience. >\\n> ---------------------------------------\\n> \\\\\\n> \\\\ \\\\\\n> \\\\ /\\\\\\n> ( )\\n> .( o ).\\n> ```\\n\\n\\n\\n\\n\\n## Walkthrough\\nAdds automated release-tag creation after successful main CI, extends release publication to accept manual tags and close milestones, and updates the v0.5.0-alpha.1 release notes, policy/docs/tests, and crate version.\\n\\n## Changes\\n\\n**Release automation and v0.5 rollout**\\n\\n|Layer / File(s)|Summary|\\n|---|---|\\n|**Auto-release workflow entry**
`.github/workflows/auto-release-tag.yml`|The new workflow runs after successful CI on main, gates on the workflow_run result, and checks out the triggering commit.|\\n|**Tag derivation and dispatch**
`.github/workflows/auto-release-tag.yml`|The workflow finds one merged release-prep PR, derives the release tag, verifies the release notes file, creates or verifies the annotated tag, and dispatches `release.yml`.|\\n|**Release workflow publication path**
`.github/workflows/release.yml`|`release.yml` accepts a manual tag input, adjusts permissions and concurrency, and validates the selected tag against GitHub milestones before publishing and closing the milestone.|\\n|**Release notes document**
`docs/releases/v0.5.0-alpha.1.md`|The new v0.5.0-alpha.1 release notes document defines the release type, included Gate C admission artifacts, non-goals, merge gates, and publication plan.|\\n|**Release metadata and surfaced links**
`CHANGELOG.md`, `README.md`, `ROADMAP.md`, `docs/README.md`, `crates/edict-syntax/Cargo.toml`|The changelog, README, roadmap, docs index, and crate version are updated to surface v0.5.0-alpha.1 and the new release issue 42.|\\n|**Release-process policy and validation**
`docs/topics/release-process/*`, `xtask/src/main.rs`|The release-process docs, policy, runbook, test plan, and xtask assertions are updated for auto-tagging, manual dispatch, milestone closure, and the v0.5 boundary.|\\n\\n## Estimated code review effort\\n🎯 4 (Complex) | ⏱️ ~60 minutes\\n\\n## Possibly related PRs\\n- [flyingrobots/edict#14](https://github.com/flyingrobots/edict/pull/14) — Also updates the README status and implementation-scope text around the same release progression.\\n- [flyingrobots/edict#26](https://github.com/flyingrobots/edict/pull/26) — Also extends `xtask/src/main.rs` checks for release-process workflow and policy structure.\\n\\n## Poem\\n> A tag was born on main’s clean track, \\n> Then milestones nodded, no turning back. \\n> Notes and gates aligned with care, \\n> A prerelease drifts through the air, \\n> And tests keep time with a steady spark.\\n\\n\\n\\n\\n

\\n

🚥 Pre-merge checks | ✅ 5

\\n\\n

\\n

✅ Passed checks (5 passed)

\\n\\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\\n\\n

\\n\\n\\n\\n\\n---\\n\\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=flyingrobots/edict&utm_content=43)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\\n\\n

\\n

❤️ Share

\\n\\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\\n\\n

\\n\\n\\n_{Comment `@coderabbitai help` to get the list of available commands.}\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_🔒 Security & Privacy_ | _🟠 Major_\\n\\n

\\n

🧩 Analysis chain

\\n\\n🏁 Script executed:\\n\\n```shell\\ncat -n .github/workflows/auto-release-tag.yml\\n```\\n\\nRepository: flyingrobots/edict\\n\\nLength of output: 5007\\n\\n---\\n\\n\\n\\n

\\n\\n**Split the privileged `workflow_run` job into distinct stages.**\\n\\nThe current single `tag-release` job inherits excessive `actions: write` and `contents: write` permissions globally. This is unacceptable for a workflow listening to external webhooks.\\n\\n1. **Isolate Content Writes:** The script identifying the release PR (lines 35–82) only needs `pull-requests: read` and `contents: read`. Currently, it runs with full write access.\\n2. **Isolate Tag Creation:** The `git push` operation (line 112) is the *only* step needing `contents: write`. It does not need `actions: write`.\\n3. **Isolate Dispatch:** The `gh workflow run` command (line 124) triggers a subsequent workflow. It requires `actions: write` but should not retain `contents: write`.\\n\\nRefactor into chained jobs (`identify` -> `tag` -> `dispatch`) or use a permission matrix so the `create tag` step does not sit dormant with `actions` privileges. Minimize blast radius for the `workflow_run` trigger.\\n\\n

\\n

🧰 Tools

\\n\\n

\\n

🪛 zizmor (1.26.1)

\\n\\n[error] 10-10: overly broad permissions (excessive-permissions): actions: write is overly broad at the workflow level\\n\\n(excessive-permissions)\\n\\n---\\n\\n[error] 11-11: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level\\n\\n(excessive-permissions)\\n\\n---\\n\\n[warning] 10-10: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\\n\\n(undocumented-permissions)\\n\\n

\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn @.github/workflows/auto-release-tag.yml around lines 9 - 12, The workflow_run\\njob is over-privileged because the single tag-release job currently holds\\nactions: write and contents: write for every step. Split the logic in\\nauto-release-tag into separate stages or jobs around the existing\\nidentify/tag/dispatch flow so the release-PR lookup runs with only\\npull-requests: read and contents: read, the git push step in the tag creation\\npath gets only contents: write, and the gh workflow run dispatch step gets only\\nactions: write; keep the permissions scoped to the specific job or stage names\\nused in the current release tagging flow.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n_Source: Linters/SAST tools_\\n\\n\\n\\n✅ Addressed in commits 1bbc598 to 7aafe0c\",\"path\":\".github/workflows/auto-release-tag.yml\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_🗄️ Data Integrity & Integration_ | _🟠 Major_\\n\\n**The release gate will catastrophically fail any repository with a history exceeding 100 milestones.**\\n\\nThe GitHub API enforces pagination. Without the `--paginate` flag, `gh api` returns only the first page. Consequently, if the target milestone resides beyond the 100th record, the lookup returns empty, triggering a spurious `exit 1` that blocks valid releases. This is brittle engineering that ignores the reality of long-lived repositories. The `--paginate` flag is mandatory to traverse the full dataset.\\n\\n

\\n

Required Fix

\\n\\n```diff\\n MILESTONE_JSON=\\\"$(gh api \\\"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\\\" \\\\\\n+ --paginate \\\\\\n --jq \\\".[] | select(.title == \\\\\\\"${TAG}\\\\\\\")\\\")\\\"\\n```\\n\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn @.github/workflows/release.yml around lines 65 - 66, The milestone lookup in\\nthe release workflow is only querying the first page of GitHub results, so it\\ncan miss the target milestone in long-lived repositories. Update the gh api call\\nin the release job to use pagination so the milestone search in the\\nMILESTONE_JSON assignment traverses all pages before the jq filter runs, keeping\\nthe existing TAG-based lookup intact.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n✅ Addressed in commits 1bbc598 to 7aafe0c\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\\n\\n**This guard does not prove milestone closure happens after publication.**\\n\\nThe test only checks for milestone-related substrings. A workflow that moved `Close release milestone` above `Publish GitHub release`, or stopped wiring the close step to `steps.release.outputs.*`, would still pass while violating RELEASE-REQ-013 and the implemented oracle in `docs/topics/release-process/test-plan.md`.\\n\\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\\n\\n \\n\\n

\\n

Suggested hardening

\\n\\n```diff\\n fn release_workflow_supports_dispatch_and_milestone_closure() {\\n let root = repo_root().expect(\\\"repo root\\\");\\n let workflow =\\n fs::read_to_string(root.join(\\\".github/workflows/release.yml\\\")).expect(\\\"workflow\\\");\\n@@\\n for needle in [\\n \\\"workflow_dispatch:\\\",\\n \\\"RELEASE_TAG:\\\",\\n \\\"inputs.tag\\\",\\n \\\"issues: write\\\",\\n \\\"milestones?state=all\\\",\\n \\\"OPEN_ISSUES\\\",\\n \\\"gh release view\\\",\\n \\\"Close release milestone\\\",\\n \\\"--method PATCH\\\",\\n \\\"-f state=closed\\\",\\n ] {\\n assert!(\\n workflow.contains(needle),\\n \\\"release workflow missing dispatch/milestone guard: {needle}\\\"\\n );\\n }\\n+\\n+ let publish_idx = workflow\\n+ .find(\\\"name: Publish GitHub release\\\")\\n+ .expect(\\\"publish step must exist\\\");\\n+ let close_idx = workflow\\n+ .find(\\\"name: Close release milestone\\\")\\n+ .expect(\\\"milestone-close step must exist\\\");\\n+ assert!(\\n+ publish_idx < close_idx,\\n+ \\\"milestone must be closed only after release publication\\\"\\n+ );\\n+\\n+ let close_step = &workflow[close_idx..];\\n+ assert!(\\n+ close_step.contains(\\\"steps.release.outputs.milestone_number\\\")\\n+ && close_step.contains(\\\"steps.release.outputs.milestone_state\\\"),\\n+ \\\"milestone close step must consume verified milestone outputs\\\"\\n+ );\\n }\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n> ‼️ **IMPORTANT**\\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\\n\\n```suggestion\\n fn release_workflow_supports_dispatch_and_milestone_closure() {\\n let root = repo_root().expect(\\\"repo root\\\");\\n let workflow =\\n fs::read_to_string(root.join(\\\".github/workflows/release.yml\\\")).expect(\\\"workflow\\\");\\n for needle in [\\n \\\"workflow_dispatch:\\\",\\n \\\"RELEASE_TAG:\\\",\\n \\\"inputs.tag\\\",\\n \\\"issues: write\\\",\\n \\\"milestones?state=all\\\",\\n \\\"OPEN_ISSUES\\\",\\n \\\"gh release view\\\",\\n \\\"Close release milestone\\\",\\n \\\"--method PATCH\\\",\\n \\\"-f state=closed\\\",\\n ] {\\n assert!(\\n workflow.contains(needle),\\n \\\"release workflow missing dispatch/milestone guard: {needle}\\\"\\n );\\n }\\n\\n let publish_idx = workflow\\n .find(\\\"name: Publish GitHub release\\\")\\n .expect(\\\"publish step must exist\\\");\\n let close_idx = workflow\\n .find(\\\"name: Close release milestone\\\")\\n .expect(\\\"milestone-close step must exist\\\");\\n assert!(\\n publish_idx < close_idx,\\n \\\"milestone must be closed only after release publication\\\"\\n );\\n\\n let close_step = &workflow[close_idx..];\\n assert!(\\n close_step.contains(\\\"steps.release.outputs.milestone_number\\\")\\n && close_step.contains(\\\"steps.release.outputs.milestone_state\\\"),\\n \\\"milestone close step must consume verified milestone outputs\\\"\\n );\\n }\\n```\\n\\n

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@xtask/src/main.rs` around lines 880 - 901, The current guard in\\nrelease_workflow_supports_dispatch_and_milestone_closure only checks for\\nmilestone-related text, so it can miss ordering and wiring regressions. Harden\\nthis test by inspecting the release workflow structure around Publish GitHub\\nrelease and Close release milestone, and assert that the close step runs only\\nafter the publish step and is driven by steps.release.outputs.* rather than just\\nmatching substrings. Use the existing\\nrelease_workflow_supports_dispatch_and_milestone_closure test and the\\nrelease.yml workflow contract as the target for the behavior check.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n_Source: Coding guidelines_\\n\\n\\n\\n✅ Addressed in commits 1bbc598 to 7aafe0c\",\"path\":\"xtask/src/main.rs\",\"side\":\"RIGHT\",\"line\":975}{\"type\":\"pull_request_comment\",\"body\":\"_🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\\n\\n**Assert the `workflow_run.event == 'push'` gate too.**\\n\\nLine 912 only checks for successful CI. If `.github/workflows/auto-release-tag.yml` lost the `github.event.workflow_run.event == 'push'` predicate, this test would still pass and the auto-tagger could start reacting to non-post-merge CI runs instead of only merged-into-`main` runs.\\n\\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\\n\\n \\n\\n

\\n

Suggested fix

\\n\\n```diff\\n for needle in [\\n \\\"workflow_run:\\\",\\n \\\"workflows: [\\\\\\\"CI\\\\\\\"]\\\",\\n \\\"branches: [main]\\\",\\n \\\"github.event.workflow_run.conclusion == 'success'\\\",\\n+ \\\"github.event.workflow_run.event == 'push'\\\",\\n \\\"/commits/${SHA}/pulls\\\",\\n \\\"^release/v[0-9]+\\\",\\n \\\"docs/releases/${TAG}.md\\\",\\n \\\"git tag -a\\\",\\n \\\"refusing to move\\\",\\n```\\n

\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n> ‼️ **IMPORTANT**\\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\\n\\n```suggestion\\n fn auto_release_tag_workflow_is_guarded() {\\n let root = repo_root().expect(\\\"repo root\\\");\\n let workflow = fs::read_to_string(root.join(\\\".github/workflows/auto-release-tag.yml\\\"))\\n .expect(\\\"auto release workflow\\\");\\n for needle in [\\n \\\"workflow_run:\\\",\\n \\\"workflows: [\\\\\\\"CI\\\\\\\"]\\\",\\n \\\"branches: [main]\\\",\\n \\\"github.event.workflow_run.conclusion == 'success'\\\",\\n \\\"github.event.workflow_run.event == 'push'\\\",\\n \\\"/commits/${SHA}/pulls\\\",\\n \\\"^release/v[0-9]+\\\",\\n \\\"docs/releases/${TAG}.md\\\",\\n \\\"git tag -a\\\",\\n \\\"refusing to move\\\",\\n \\\"gh workflow run release.yml\\\",\\n \\\"actions: write\\\",\\n ] {\\n assert!(\\n workflow.contains(needle),\\n \\\"auto release workflow missing guard/action: {needle}\\\"\\n );\\n }\\n assert!(\\n !workflow.contains(\\\"--force\\\"),\\n \\\"auto release workflow must not force any git operation\\\"\\n );\\n```\\n\\n

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@xtask/src/main.rs` around lines 904 - 929, The auto-release workflow guard\\ntest is missing coverage for the push-event predicate, so update\\nauto_release_tag_workflow_is_guarded in xtask/src/main.rs to also assert the\\nworkflow contains github.event.workflow_run.event == 'push'. Keep the existing\\nchecks around workflow_run, CI, main, and success, but add the missing guard\\nstring so the test fails if the auto-tagger starts reacting to non-merge CI\\nruns.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n_Source: Coding guidelines_\\n\\n\\n\\n✅ Addressed in commits 1bbc598 to 7aafe0c\",\"path\":\"xtask/src/main.rs\",\"side\":\"RIGHT\",\"line\":1006}{\"type\":\"pull_request_comment\",\"body\":\"**Actionable comments posted: 4**\\n\\n> [!CAUTION]\\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\\n> \\n> \\n> \\n>

\\n>

⚠️ Outside diff range comments (1)

\\n> \\n>
\\n>
docs/topics/release-process/runbook.md (1)
\\n> \\n> `103-110`: _🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\\n> \\n> **Anchor the fallback tag to refreshed `main`, not implicit `HEAD`.**\\n> \\n> Line 103 removes the old “refresh local `main` first” guard, but the fallback still uses `git tag -a ...` with no target. If an operator runs this from a stale checkout or the old `release/...-prep` branch, the tag can land on the wrong commit, and `release.yml` would still accept any older commit that is merely reachable from `origin/main`.\\n> \\n> As per coding guidelines, “Documentation is a product interface, not a Markdown inventory.”\\n> \\n> \\n> \\n>
\\n>
Suggested fix
\\n> \\n> ```diff\\n> Manual tagging is now an operator fallback, not the normal path. If automation\\n> does not run and the release-prep merge commit has been verified on `main`, the\\n> fallback is:\\n> \\n> ```bash\\n> +git switch main\\n> +git fetch origin\\n> +git merge --ff-only origin/main\\n> -git tag -a vX.Y.Z-alpha.N -m \\\"vX.Y.Z-alpha.N\\\"\\n> +git tag -a vX.Y.Z-alpha.N origin/main -m \\\"vX.Y.Z-alpha.N\\\"\\n> git push origin vX.Y.Z-alpha.N\\n> ```\\n> ```\\n>
\\n> \\n>
\\n>
🤖 Prompt for AI Agents
\\n> \\n> ```\\n> Verify each finding against current code. Fix only still-valid issues, skip the\\n> rest with a brief reason, keep changes minimal, and validate.\\n> \\n> In `@docs/topics/release-process/runbook.md` around lines 103 - 110, The fallback\\n> tagging step in the release-process runbook can tag the wrong commit because\\n> `git tag -a` is currently using the operator’s implicit `HEAD`. Update the\\n> instructions around the manual fallback to first refresh local `main` from\\n> `origin/main` (for example via the existing release flow context), then make\\n> `git tag -a` explicitly point at `origin/main` so the tag is anchored to the\\n> verified commit. Use the existing release-prep fallback section and the `git tag\\n> -a` / `git push origin` steps as the place to adjust the guidance.\\n> ```\\n> \\n>
\\n> \\n> \\n> \\n> _Source: Coding guidelines_\\n> \\n>
\\n> \\n>

\\n\\n

\\n

🤖 Prompt for all review comments with AI agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nInline comments:\\nIn @.github/workflows/auto-release-tag.yml:\\n- Around line 9-12: The workflow_run job is over-privileged because the single\\ntag-release job currently holds actions: write and contents: write for every\\nstep. Split the logic in auto-release-tag into separate stages or jobs around\\nthe existing identify/tag/dispatch flow so the release-PR lookup runs with only\\npull-requests: read and contents: read, the git push step in the tag creation\\npath gets only contents: write, and the gh workflow run dispatch step gets only\\nactions: write; keep the permissions scoped to the specific job or stage names\\nused in the current release tagging flow.\\n\\nIn @.github/workflows/release.yml:\\n- Around line 65-66: The milestone lookup in the release workflow is only\\nquerying the first page of GitHub results, so it can miss the target milestone\\nin long-lived repositories. Update the gh api call in the release job to use\\npagination so the milestone search in the MILESTONE_JSON assignment traverses\\nall pages before the jq filter runs, keeping the existing TAG-based lookup\\nintact.\\n\\nIn `@xtask/src/main.rs`:\\n- Around line 904-929: The auto-release workflow guard test is missing coverage\\nfor the push-event predicate, so update auto_release_tag_workflow_is_guarded in\\nxtask/src/main.rs to also assert the workflow contains\\ngithub.event.workflow_run.event == 'push'. Keep the existing checks around\\nworkflow_run, CI, main, and success, but add the missing guard string so the\\ntest fails if the auto-tagger starts reacting to non-merge CI runs.\\n- Around line 880-901: The current guard in\\nrelease_workflow_supports_dispatch_and_milestone_closure only checks for\\nmilestone-related text, so it can miss ordering and wiring regressions. Harden\\nthis test by inspecting the release workflow structure around Publish GitHub\\nrelease and Close release milestone, and assert that the close step runs only\\nafter the publish step and is driven by steps.release.outputs.* rather than just\\nmatching substrings. Use the existing\\nrelease_workflow_supports_dispatch_and_milestone_closure test and the\\nrelease.yml workflow contract as the target for the behavior check.\\n\\n---\\n\\nOutside diff comments:\\nIn `@docs/topics/release-process/runbook.md`:\\n- Around line 103-110: The fallback tagging step in the release-process runbook\\ncan tag the wrong commit because `git tag -a` is currently using the operator’s\\nimplicit `HEAD`. Update the instructions around the manual fallback to first\\nrefresh local `main` from `origin/main` (for example via the existing release\\nflow context), then make `git tag -a` explicitly point at `origin/main` so the\\ntag is anchored to the verified commit. Use the existing release-prep fallback\\nsection and the `git tag -a` / `git push origin` steps as the place to adjust\\nthe guidance.\\n```\\n\\n

\\n\\n

\\n

🪄 Autofix (Beta)

\\n\\nFix all unresolved CodeRabbit comments on this PR:\\n\\n- [ ] Push a commit to this branch (recommended)\\n- [ ] Create a new PR with the fixes\\n\\n

\\n\\n---\\n\\n

\\n

ℹ️ Review info

\\n\\n

\\n

⚙️ Run configuration

\\n\\n**Configuration used**: Organization UI\\n\\n**Review profile**: ASSERTIVE\\n\\n**Plan**: Pro\\n\\n**Run ID**: `9e7a759d-bc04-4541-bea9-7fa80f31de67`\\n\\n

\\n\\n

\\n

📥 Commits

\\n\\nReviewing files that changed from the base of the PR and between dcd5677c3710d0869009d2e82a6da1bf4175cc8a and 87f394073787aa0a555a5b503ed2ea8e8e911bd5.\\n\\n

\\n\\n

\\n

⛔ Files ignored due to path filters (1)

\\n\\n* `Cargo.lock` is excluded by `!**/*.lock`\\n\\n

\\n\\n

\\n

📒 Files selected for processing (13)

\\n\\n* `.github/workflows/auto-release-tag.yml`\\n* `.github/workflows/release.yml`\\n* `CHANGELOG.md`\\n* `README.md`\\n* `ROADMAP.md`\\n* `crates/edict-syntax/Cargo.toml`\\n* `docs/README.md`\\n* `docs/releases/v0.5.0-alpha.1.md`\\n* `docs/topics/release-process/README.md`\\n* `docs/topics/release-process/policy.toml`\\n* `docs/topics/release-process/runbook.md`\\n* `docs/topics/release-process/test-plan.md`\\n* `xtask/src/main.rs`\\n\\n

\\n\\n

\\n

📜 Review details

\\n\\n

\\n

🧰 Additional context used

\\n\\n

\\n

📓 Path-based instructions (3)

\\n\\n

\\n

\\n\\n\\n**⚙️ CodeRabbit configuration file**\\n\\n> `**`: # AGENTS\\n> \\n> ## Git Rules\\n> \\n> NEVER amend git commits. Make a new commit instead.\\n> \\n> NEVER use `git rebase` unless the user explicitly approves a rare exception.\\n> Use regular merge commits.\\n> \\n> NEVER force any git operation. If a force operation appears necessary, stop and\\n> explain what happened and what options remain.\\n> \\n> NEVER create draft pull requests.\\n> \\n> NEVER use a `codex` prefix in branch names, PR titles, or commit messages.\\n> \\n> Pull request bodies for issue work MUST include GitHub auto-close text such as\\n> `Closes `#123`` for every issue the PR is intended to close.\\n> \\n> ## Think\\n> \\n> Think is durable memory for cross-session coordination.\\n> \\n> - Use `codex-think --remember --json` when starting a new session, changing into\\n> this repository, or regaining context after a context shift.\\n> - Use `codex-think \\\"...\\\" --json` when a cycle closes or a significant event\\n> should survive across turns.\\n> - Treat Think as memory, not repo truth. Anchor strong claims back to files,\\n> commits, commands, issues, or pull requests.\\n> - Claude memories are read-only. Use `claude-think --remember --json` only for\\n> additional context.\\n> \\n> ## Topic Shelves\\n> \\n> `docs/topics/` contains the living contract graph for landed behavior. Topic\\n> shelves are not proposals, retrospectives, or design archaeology.\\n> \\n> Each shelf may contain:\\n> \\n> - `README.md`: what is true in HEAD.\\n> - `test-plan.md`: how those truths are verified, including requirements, cases,\\n> fixtures, oracles, implemented evidence, planned cases, and known gaps.\\n> - `architecture.md`: optional structure or dataflow notes when the machinery\\n> earns a separate page.\\n> - `rationale.md`: optional still-relevant tradeoffs and rejected approaches.\\n> \\n> ### When To Update Topic Shelves\\n> \\n> For every nontrivial behavior, contract, workflow, release, schema, validation,\\n> or public-surface change:\\n> \\n> 1. Identify the owning topic shelf before editing code.\\n> 2. If no shelf owns durable behavior, create one.\\n> 3. Update `test-plan.md` before or alongside tests with requirement IDs, case\\n> IDs,...\\n\\nFiles:\\n- `crates/edict-syntax/Cargo.toml`\\n- `CHANGELOG.md`\\n- `docs/releases/v0.5.0-alpha.1.md`\\n- `ROADMAP.md`\\n- `docs/topics/release-process/README.md`\\n- `README.md`\\n- `docs/README.md`\\n- `docs/topics/release-process/policy.toml`\\n- `docs/topics/release-process/runbook.md`\\n- `xtask/src/main.rs`\\n- `docs/topics/release-process/test-plan.md`\\n\\n

\\n

docs/topics/**/README.md

\\n\\n\\n**📄 CodeRabbit inference engine (AGENTS.md)**\\n\\n> `docs/topics/**/README.md`: Topic shelf `README.md` files must describe only what is true in HEAD.\\n> Update the topic shelf `README.md` only after the behavior exists in the branch; do not describe intended future behavior there.\\n> Do not churn topic-shelf README files for purely mechanical edits that do not change a contract.\\n\\nFiles:\\n- `docs/topics/release-process/README.md`\\n\\n

\\n

docs/topics/**/test-plan.md

\\n\\n\\n**📄 CodeRabbit inference engine (AGENTS.md)**\\n\\n> `docs/topics/**/test-plan.md`: Update a topic shelf `test-plan.md` before or alongside tests with requirement IDs, case IDs, fixtures, oracles, implemented evidence, planned cases, and known gaps.\\n> Mark planned cases as implemented only when executable evidence exists.\\n> Do not use `policy` rows in topic-shelf test plans to avoid writing behavior tests for software behavior.\\n> Negative tests in topic-shelf test plans should assert stable error kinds or structured artifacts, not merely `is_err()` or diagnostic text.\\n> For nontrivial behavior, contract, workflow, release, schema, validation, or public-surface changes, update the owning topic `test-plan.md` with planned requirement and case rows before or alongside the first test.\\n> Mark planned rows as implemented only after executable evidence exists.\\n\\nFiles:\\n- `docs/topics/release-process/test-plan.md`\\n\\n

\\n\\n

\\n

🪛 LanguageTool

\\n\\n

\\n

docs/topics/release-process/README.md

\\n\\n[uncategorized] ~11-~11: The official name of this software platform is spelled with a capital “H”.\\nContext: ...Edict publishes GitHub releases through `.github/workflows/release.yml`. A release can b...\\n\\n(GITHUB)\\n\\n---\\n\\n[uncategorized] ~16-~16: The official name of this software platform is spelled with a capital “H”.\\nContext: ...p PR merge. When `CI` passes on `main`, `.github/workflows/auto-release-tag.yml` checks ...\\n\\n(GITHUB)\\n\\n

\\n

docs/topics/release-process/runbook.md

\\n\\n[uncategorized] ~90-~90: The official name of this software platform is spelled with a capital “H”.\\nContext: ...w runs on `main`. If that run succeeds, `.github/workflows/auto-release-tag.yml` checks ...\\n\\n(GITHUB)\\n\\n

\\n

docs/topics/release-process/test-plan.md

\\n\\n[uncategorized] ~42-~42: The official name of this software platform is spelled with a capital “H”.\\nContext: ... and dispatches release publication. | .github/workflows/auto-release-tag.yml, docs/to...\\n\\n(GITHUB)\\n\\n---\\n\\n[uncategorized] ~43-~43: The official name of this software platform is spelled with a capital “H”.\\nContext: ... the milestone has zero open issues. | .github/workflows/release.yml, docs/topics/rele...\\n\\n(GITHUB)\\n\\n---\\n\\n[uncategorized] ~55-~55: The official name of this software platform is spelled with a capital “H”.\\nContext: ... full tag name after auto-tagging. | | .github/workflows/auto-release-tag.yml | Succes...\\n\\n(GITHUB)\\n\\n---\\n\\n[uncategorized] ~71-~71: The official name of this software platform is spelled with a capital “H”.\\nContext: ...ports_dispatch_and_milestone_closure | .github/workflows/auto-release-tag.yml, .github...\\n\\n(GITHUB)\\n\\n---\\n\\n[uncategorized] ~71-~71: The official name of this software platform is spelled with a capital “H”.\\nContext: ...github/workflows/auto-release-tag.yml, .github/workflows/release.yml, docs/topics/rele...\\n\\n(GITHUB)\\n\\n

\\n\\n

\\n

🪛 zizmor (1.26.1)

\\n\\n

\\n

.github/workflows/release.yml

\\n\\n[error] 15-15: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level\\n\\n(excessive-permissions)\\n\\n---\\n\\n[error] 16-16: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level\\n\\n(excessive-permissions)\\n\\n---\\n\\n[warning] 15-15: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\\n\\n(undocumented-permissions)\\n\\n---\\n\\n[info] 131-131: code injection via template expansion (template-injection): may expand into attacker-controllable code\\n\\n(template-injection)\\n\\n---\\n\\n[info] 132-132: code injection via template expansion (template-injection): may expand into attacker-controllable code\\n\\n(template-injection)\\n\\n

\\n

.github/workflows/auto-release-tag.yml

\\n\\n[warning] 24-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false\\n\\n(artipacked)\\n\\n---\\n\\n[error] 10-10: overly broad permissions (excessive-permissions): actions: write is overly broad at the workflow level\\n\\n(excessive-permissions)\\n\\n---\\n\\n[error] 11-11: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level\\n\\n(excessive-permissions)\\n\\n---\\n\\n[error] 3-7: use of fundamentally insecure workflow trigger (dangerous-triggers): workflow_run is almost always used insecurely\\n\\n(dangerous-triggers)\\n\\n---\\n\\n[warning] 10-10: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\\n\\n(undocumented-permissions)\\n\\n

\\n\\n

\\n

🔇 Additional comments (8)

\\n\\n
\\n
docs/releases/v0.5.0-alpha.1.md (1)
\\n\\n`1-96`: LGTM!\\n\\n\\n\\n
\\n
\\n
crates/edict-syntax/Cargo.toml (1)
\\n\\n`3-3`: LGTM!\\n\\n\\n\\n
\\n
\\n
CHANGELOG.md (1)
\\n\\n`11-12`: LGTM!\\n\\n\\n\\n
\\n
\\n
README.md (1)
\\n\\n`462-465`: LGTM!\\n\\n\\n\\nAlso applies to: 494-495, 514-524\\n\\n\\n\\n
\\n
\\n
ROADMAP.md (1)
\\n\\n`180-181`: LGTM!\\n\\n\\n\\nAlso applies to: 195-195, 247-247\\n\\n\\n\\n
\\n
\\n
docs/README.md (1)
\\n\\n`16-19`: LGTM!\\n\\n\\n\\n
\\n
\\n
.github/workflows/auto-release-tag.yml (1)
\\n\\n`29-83`: LGTM!\\n\\n\\n\\nAlso applies to: 84-113, 115-124\\n\\n\\n\\n
\\n
\\n
.github/workflows/release.yml (1)
\\n\\n`7-53`: LGTM!\\n\\n\\n\\nAlso applies to: 73-87, 95-123, 124-142\\n\\n\\n\\n
\\n\\n

\\n\\n

\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Dispatch releases from the tagged ref**\\n\\nIn the auto-release path, `gh workflow run --ref main` starts the Release workflow from whatever `main` points at when the dispatch is processed; the gh manual defines `--ref` as the branch or tag containing the workflow version. If another commit lands on `main` after CI succeeded for the release merge but before this dispatch runs, `release.yml` checks out that newer commit and reads `docs/releases/${TAG}.md` from it while publishing the tag created at `SHA`, so the release can use notes or workflow guards that were not on the verified tagged commit. Dispatch the workflow at `${TAG}` or make `release.yml` explicitly check out the tagged SHA for this automated path.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/auto-release-tag.yml\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Check the milestone before pushing the immutable tag**\\n\\nWhen a `release/*-prep` PR is merged while the matching milestone still has open issues, this step creates and pushes the immutable release tag before `release.yml` gets a chance to enforce the zero-open-milestone gate. The later Release run will fail, but the tag is already on a commit that did not pass the release gate, and the documented policy forbids moving or recreating it; run the milestone check before `git tag`/`git push` so a not-ready release does not leave behind an unusable durable tag.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/auto-release-tag.yml\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Pin manual fallback to the verified merge commit**\\n\\nIf automation fails and the operator follows this fallback from their release branch or a stale local `main`, `git tag` tags the current `HEAD`, not necessarily the release-prep merge commit that passed `main` CI. Because the Release workflow only checks that the tag target is reachable from `origin/main`, it would accept an older main ancestor or the PR head from a merge commit, leaving an immutable release tag on the wrong commit; the fallback should fetch `origin/main` and tag the verified merge SHA explicitly.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"docs/topics/release-process/runbook.md\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `87f3940737`\\n \\n\\n

ℹ️ About Codex in GitHub

\\n
\\n\\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\\n- Open a pull request for review\\n- Mark a draft as ready\\n- Comment \\\"@codex review\\\".\\n\\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\\n\\n\\n\\n\\nCodex can also answer questions or update the PR. Try commenting \\\"@codex address that feedback\\\".\\n \\n

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"## Activity Summary\\n\\n@codex second opinion requested on the resolved review queue.\\n\\n| # | Severity | Source | File | Commit | Outcome |\\n| --- | --- | --- | --- | --- | --- |\\n| 1 | P2 | PR | `.github/workflows/auto-release-tag.yml` | `1bbc598` | Split auto-release into scoped identify/tag/dispatch jobs with least privilege. |\\n| 2 | P2 | PR | `.github/workflows/auto-release-tag.yml` | `3d6f79d` | Checked matching milestone and zero open issues before creating immutable tags. |\\n| 3 | P2 | PR | `.github/workflows/auto-release-tag.yml` | `4699430` | Dispatches `release.yml` from the created tag ref instead of moving `main`. |\\n| 4 | P2 | PR | `docs/topics/release-process/runbook.md` | `d4ef31e` | Manual fallback now tags an explicit verified main merge commit. |\\n| 5 | P2 | PR | `.github/workflows/release.yml` | `e646f5f` | Release milestone lookup now paginates all milestone pages. |\\n| 6 | P3 | PR | `xtask/src/main.rs` | `01fe756` | Release workflow test now asserts publish-before-milestone-close ordering and output wiring. |\\n| 7 | P3 | PR | `xtask/src/main.rs` | `8c9f779` | Auto-release test and policy now assert the `workflow_run.event == 'push'` guard. |\\n| 8 | P5 | Verify | `xtask/src/main.rs` | `7aafe0c` | Applied required `cargo fmt` formatting follow-up without amending prior commits. |\\n\\nValidation:\\n\\n- `actionlint`\\n- `git diff --check origin/main...HEAD`\\n- `cargo test -p xtask release_`\\n- `cargo xtask verify`\\n\\nAll previously unresolved review threads were resolved via GraphQL after the fixes were pushed.\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"_🔒 Security & Privacy_ | _🟠 Major_\\n\\n**Kill the persisted `contents: write` suicide pact immediately; harden with `persist-credentials: false` and explicit ephemeral auth.**\\n\\nThe `actions/checkout` action defaults to `persist-credentials: true`, which scrawls your elevated `GITHUB_TOKEN` directly into the runner's local git config. While the `auto-release-tag.yml` workflow currently restricts scope to a single job, leaving a write-token on the workspace disk is negligence. It transforms a controlled network operation into a persistent filesystem liability.\\n\\nSanitize the checkout at **Lines 99–102** to strip credential persistence:\\n\\n```diff\\n - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\\n with:\\n ref: ${{ needs.identify-release-pr.outputs.sha }}\\n fetch-depth: 0\\n+ persist-credentials: false\\n```\\n\\nUpdate the **`Create immutable release tag`** step (Lines 132–147) to inject authentication strictly on a per-command basis:\\n\\n1. Pass the bearer token via `git -c` for `ls-remote`, `fetch`, and `push`.\\n2. Do **not** rely on the runner's cached credentials.\\n\\nThe token lives only in the runner's memory for the exact duration of the network call. Execute immediately.\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n\\n\\n

\\n

🧰 Tools

\\n\\n

\\n

🪛 zizmor (1.26.1)

\\n\\n[warning] 99-102: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false\\n\\n(artipacked)\\n\\n

\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn @.github/workflows/auto-release-tag.yml around lines 99 - 102, The checkout\\nin the auto-release tagging workflow is persisting write credentials on disk, so\\nupdate the existing actions/checkout step to disable credential persistence with\\npersist-credentials: false. Then harden the Create immutable release tag step by\\nremoving any reliance on cached git auth and using explicit per-command\\nauthentication for the git ls-remote, fetch, and push operations, referring to\\nthe checkout and release-tagging logic so the token is only used transiently in\\neach command.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\",\"path\":\".github/workflows/auto-release-tag.yml\",\"side\":\"RIGHT\",\"line\":102}{\"type\":\"pull_request_comment\",\"body\":\"_📐 Maintainability & Code Quality_ | _🟠 Major_ | _⚡ Quick win_\\n\\n**Bind the pagination check to the milestone lookup, not any random API call.**\\n\\nLine 931 only proves `release.yml` contains some `gh api --paginate`. An unrelated paginated call would satisfy this while milestone lookup silently regressed back to a single page.\\n\\n

\\n

Suggested hardening

\\n\\n```diff\\n #[test]\\n fn release_workflow_paginates_milestone_lookup() {\\n let root = repo_root().expect(\\\"repo root\\\");\\n let workflow =\\n fs::read_to_string(root.join(\\\".github/workflows/release.yml\\\")).expect(\\\"workflow\\\");\\n assert!(\\n- workflow.contains(\\\"gh api --paginate\\\"),\\n- \\\"release workflow must paginate milestone lookup\\\"\\n+ workflow.contains(\\n+ r#\\\"gh api --paginate \\\"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\\\"\\\"#\\n+ ),\\n+ \\\"release workflow must paginate the milestone lookup itself\\\"\\n );\\n }\\n```\\n

\\n\\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@xtask/src/main.rs` around lines 925 - 933, The release workflow test is too\\nbroad because release_workflow_paginates_milestone_lookup only checks for any gh\\napi --paginate usage instead of the milestone lookup specifically. Tighten the\\nassertion in xtask/src/main.rs so it matches the milestone lookup command in\\nrelease.yml, using the existing release_workflow_paginates_milestone_lookup test\\nand workflow content to verify the paginated call is tied to milestone retrieval\\nrather than any unrelated API call.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n_Source: Coding guidelines_\\n\\n\\n\\n✅ Addressed in commits e6ab7cc to ca19915\",\"path\":\"xtask/src/main.rs\",\"side\":\"RIGHT\",\"line\":974}{\"type\":\"pull_request_comment\",\"body\":\"_🔒 Security & Privacy_ | _🟠 Major_ | _⚡ Quick win_\\n\\n**These permission checks do not prove job-local least privilege.**\\n\\nThis test only checks that the file mentions the job names and permission strings somewhere. It still passes if `actions: write` or `contents: write` moves to a broader scope, which is exactly the regression this guard is supposed to catch.\\n\\n

\\n

Suggested hardening

\\n\\n```diff\\n #[test]\\n fn auto_release_tag_workflow_scopes_job_permissions() {\\n let root = repo_root().expect(\\\"repo root\\\");\\n let workflow = fs::read_to_string(root.join(\\\".github/workflows/auto-release-tag.yml\\\"))\\n .expect(\\\"auto release workflow\\\");\\n- for required in [\\n- \\\"identify-release-pr:\\\",\\n- \\\"contents: read\\\",\\n- \\\"pull-requests: read\\\",\\n- \\\"create-release-tag:\\\",\\n- \\\"contents: write\\\",\\n- \\\"dispatch-release-publication:\\\",\\n- \\\"actions: write\\\",\\n- ] {\\n- assert!(\\n- workflow.contains(required),\\n- \\\"auto release workflow missing scoped job permission contract: {required}\\\"\\n- );\\n- }\\n+ let identify_start = workflow\\n+ .find(\\\"identify-release-pr:\\\")\\n+ .expect(\\\"identify-release-pr job must exist\\\");\\n+ let create_start = workflow\\n+ .find(\\\"create-release-tag:\\\")\\n+ .expect(\\\"create-release-tag job must exist\\\");\\n+ let dispatch_start = workflow\\n+ .find(\\\"dispatch-release-publication:\\\")\\n+ .expect(\\\"dispatch-release-publication job must exist\\\");\\n+\\n+ let identify_job = &workflow[identify_start..create_start];\\n+ let create_job = &workflow[create_start..dispatch_start];\\n+ let dispatch_job = &workflow[dispatch_start..];\\n+\\n+ assert!(\\n+ identify_job.contains(\\\"contents: read\\\")\\n+ && identify_job.contains(\\\"pull-requests: read\\\"),\\n+ \\\"identify-release-pr must stay read-only\\\"\\n+ );\\n+ assert!(\\n+ create_job.contains(\\\"contents: write\\\"),\\n+ \\\"create-release-tag must retain tag-write permission\\\"\\n+ );\\n+ assert!(\\n+ dispatch_job.contains(\\\"actions: write\\\"),\\n+ \\\"dispatch-release-publication must retain workflow-dispatch permission\\\"\\n+ );\\n }\\n```\\n

\\n\\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\\n\\n\\n\\n

\\n

📝 Committable suggestion

\\n\\n> ‼️ **IMPORTANT**\\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\\n\\n```suggestion\\n fn auto_release_tag_workflow_scopes_job_permissions() {\\n let root = repo_root().expect(\\\"repo root\\\");\\n let workflow = fs::read_to_string(root.join(\\\".github/workflows/auto-release-tag.yml\\\"))\\n .expect(\\\"auto release workflow\\\");\\n let identify_start = workflow\\n .find(\\\"identify-release-pr:\\\")\\n .expect(\\\"identify-release-pr job must exist\\\");\\n let create_start = workflow\\n .find(\\\"create-release-tag:\\\")\\n .expect(\\\"create-release-tag job must exist\\\");\\n let dispatch_start = workflow\\n .find(\\\"dispatch-release-publication:\\\")\\n .expect(\\\"dispatch-release-publication job must exist\\\");\\n\\n let identify_job = &workflow[identify_start..create_start];\\n let create_job = &workflow[create_start..dispatch_start];\\n let dispatch_job = &workflow[dispatch_start..];\\n\\n assert!(\\n identify_job.contains(\\\"contents: read\\\")\\n && identify_job.contains(\\\"pull-requests: read\\\"),\\n \\\"identify-release-pr must stay read-only\\\"\\n );\\n assert!(\\n create_job.contains(\\\"contents: write\\\"),\\n \\\"create-release-tag must retain tag-write permission\\\"\\n );\\n assert!(\\n dispatch_job.contains(\\\"actions: write\\\"),\\n \\\"dispatch-release-publication must retain workflow-dispatch permission\\\"\\n );\\n }\\n```\\n\\n

\\n\\n\\n\\n

\\n

🤖 Prompt for AI Agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nIn `@xtask/src/main.rs` around lines 973 - 990, The auto-release workflow\\npermission test is too weak because it only checks for strings anywhere in the\\nYAML, so it can miss permissions leaking to a broader scope. Update\\nauto_release_tag_workflow_scopes_job_permissions to parse and inspect the\\nworkflow structure for the specific job entries identify-release-pr,\\ncreate-release-tag, and dispatch-release-publication, and assert their job-local\\npermissions exactly match the expected scoped values rather than just containing\\nthe text. Use the existing workflow-loading logic in xtask/src/main.rs to locate\\nthe job definitions and verify the permissions map for each job.\\n```\\n\\n

\\n\\n\\n\\n\\n\\n\\n\\n_Source: Coding guidelines_\\n\\n\\n\\n✅ Addressed in commits e6ab7cc to ca19915\",\"path\":\"xtask/src/main.rs\",\"side\":\"RIGHT\",\"line\":1089}{\"type\":\"pull_request_comment\",\"body\":\"**Actionable comments posted: 3**\\n\\n> [!CAUTION]\\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\\n> \\n> \\n> \\n>

\\n>

⚠️ Outside diff range comments (2)

\\n> \\n>
\\n>
docs/topics/release-process/runbook.md (1)
\\n> \\n> `134-139`: _🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\\n> \\n> **Use the real milestone query contract here.**\\n> \\n> This command is wrong for the post-release state it asks operators to verify. Without `state=all`, it will usually return nothing once the workflow has closed the milestone, and without pagination it can miss older milestones entirely. Match the workflow’s query instead.\\n> \\n>
\\n>
Suggested fix
\\n> \\n> ```diff\\n> -gh api repos/flyingrobots/edict/milestones --jq \\\\\\n> - '.[] | select(.title == \\\"vX.Y.Z-alpha.N\\\") | {title,state,open_issues}'\\n> +gh api --paginate \\\"repos/flyingrobots/edict/milestones?state=all&per_page=100\\\" --jq \\\\\\n> + '.[] | select(.title == \\\"vX.Y.Z-alpha.N\\\") | {title,state,open_issues}'\\n> ```\\n>
\\n> \\n> As per coding guidelines, documentation is a product interface, not a Markdown inventory.\\n> \\n>
\\n>
🤖 Prompt for AI Agents
\\n> \\n> ```\\n> Verify each finding against current code. Fix only still-valid issues, skip the\\n> rest with a brief reason, keep changes minimal, and validate.\\n> \\n> In `@docs/topics/release-process/runbook.md` around lines 134 - 139, The milestone\\n> verification command uses the wrong API contract for the post-release state;\\n> update the runbook’s gh api query to match the workflow’s real milestone lookup\\n> by requesting all states and handling pagination, then filter for the target\\n> milestone title and closed/zero-open-issues result. Locate the command under the\\n> release-process runbook near the milestone check, and make sure the documented\\n> query aligns with the same contract used by the release workflow so operators\\n> can still find closed milestones after release.\\n> ```\\n> \\n>
\\n> \\n> \\n> \\n> _Source: Coding guidelines_\\n> \\n>
\\n>
\\n>
.github/workflows/release.yml (1)
\\n> \\n> `37-47`: _🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\\n> \\n> **Check out the selected tag before reading release artifacts.**\\n> \\n> For `workflow_dispatch`, `RELEASE_TAG` comes from `inputs.tag`, but the workspace remains the manually selected dispatch ref. That can publish `docs/releases/${TAG}.md` from `main` or another branch instead of the immutable tag being released.\\n> \\n> \\n> \\n> \\n> \\n>
\\n>
Proposed fix
\\n> \\n> ```diff\\n> TAG=\\\"${RELEASE_TAG}\\\"\\n> VERSION=\\\"${TAG#v}\\\"\\n> - NOTES=\\\"docs/releases/${TAG}.md\\\"\\n> - TAG_COMMIT=\\\"$(git rev-parse \\\"${TAG}^{commit}\\\")\\\"\\n> \\n> if [[ ! \\\"${TAG}\\\" =~ ^v[0-9]+\\\\.[0-9]+\\\\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then\\n> echo \\\"::error::Release tag must look like a SemVer v* tag: ${TAG}\\\"\\n> exit 1\\n> fi\\n> +\\n> + TAG_COMMIT=\\\"$(git rev-parse \\\"${TAG}^{commit}\\\")\\\"\\n> @@\\n> if ! git merge-base --is-ancestor \\\"${TAG_COMMIT}\\\" origin/main; then\\n> echo \\\"::error::Release tags must target commits reachable from origin/main.\\\"\\n> echo \\\"::error::Tag ${TAG} targets ${TAG_COMMIT}, which is not on origin/main.\\\"\\n> exit 1\\n> fi\\n> +\\n> + git checkout --detach \\\"${TAG_COMMIT}\\\"\\n> + NOTES=\\\"docs/releases/${TAG}.md\\\"\\n> ```\\n> \\n>
\\n> \\n>
\\n>
🤖 Prompt for AI Agents
\\n> \\n> ```\\n> Verify each finding against current code. Fix only still-valid issues, skip the\\n> rest with a brief reason, keep changes minimal, and validate.\\n> \\n> In @.github/workflows/release.yml around lines 37 - 47, The release workflow\\n> reads release notes from the current workspace, but when RELEASE_TAG comes from\\n> inputs.tag in workflow_dispatch it may still be on the dispatch ref instead of\\n> the immutable tag. Update the release job so the checked-out revision matches\\n> TAG before using NOTES or TAG_COMMIT, and keep the logic centered around\\n> RELEASE_TAG, TAG, and TAG_COMMIT in the release shell step.\\n> ```\\n> \\n>
\\n> \\n> \\n> \\n>
\\n> \\n>

\\n\\n

\\n

🤖 Prompt for all review comments with AI agents

\\n\\n```\\nVerify each finding against current code. Fix only still-valid issues, skip the\\nrest with a brief reason, keep changes minimal, and validate.\\n\\nInline comments:\\nIn @.github/workflows/auto-release-tag.yml:\\n- Around line 99-102: The checkout in the auto-release tagging workflow is\\npersisting write credentials on disk, so update the existing actions/checkout\\nstep to disable credential persistence with persist-credentials: false. Then\\nharden the Create immutable release tag step by removing any reliance on cached\\ngit auth and using explicit per-command authentication for the git ls-remote,\\nfetch, and push operations, referring to the checkout and release-tagging logic\\nso the token is only used transiently in each command.\\n\\nIn `@xtask/src/main.rs`:\\n- Around line 925-933: The release workflow test is too broad because\\nrelease_workflow_paginates_milestone_lookup only checks for any gh api\\n--paginate usage instead of the milestone lookup specifically. Tighten the\\nassertion in xtask/src/main.rs so it matches the milestone lookup command in\\nrelease.yml, using the existing release_workflow_paginates_milestone_lookup test\\nand workflow content to verify the paginated call is tied to milestone retrieval\\nrather than any unrelated API call.\\n- Around line 973-990: The auto-release workflow permission test is too weak\\nbecause it only checks for strings anywhere in the YAML, so it can miss\\npermissions leaking to a broader scope. Update\\nauto_release_tag_workflow_scopes_job_permissions to parse and inspect the\\nworkflow structure for the specific job entries identify-release-pr,\\ncreate-release-tag, and dispatch-release-publication, and assert their job-local\\npermissions exactly match the expected scoped values rather than just containing\\nthe text. Use the existing workflow-loading logic in xtask/src/main.rs to locate\\nthe job definitions and verify the permissions map for each job.\\n\\n---\\n\\nOutside diff comments:\\nIn @.github/workflows/release.yml:\\n- Around line 37-47: The release workflow reads release notes from the current\\nworkspace, but when RELEASE_TAG comes from inputs.tag in workflow_dispatch it\\nmay still be on the dispatch ref instead of the immutable tag. Update the\\nrelease job so the checked-out revision matches TAG before using NOTES or\\nTAG_COMMIT, and keep the logic centered around RELEASE_TAG, TAG, and TAG_COMMIT\\nin the release shell step.\\n\\nIn `@docs/topics/release-process/runbook.md`:\\n- Around line 134-139: The milestone verification command uses the wrong API\\ncontract for the post-release state; update the runbook’s gh api query to match\\nthe workflow’s real milestone lookup by requesting all states and handling\\npagination, then filter for the target milestone title and\\nclosed/zero-open-issues result. Locate the command under the release-process\\nrunbook near the milestone check, and make sure the documented query aligns with\\nthe same contract used by the release workflow so operators can still find\\nclosed milestones after release.\\n```\\n\\n

\\n\\n

\\n

🪄 Autofix (Beta)

\\n\\nFix all unresolved CodeRabbit comments on this PR:\\n\\n- [ ] Push a commit to this branch (recommended)\\n- [ ] Create a new PR with the fixes\\n\\n

\\n\\n---\\n\\n

\\n

ℹ️ Review info

\\n\\n

\\n

⚙️ Run configuration

\\n\\n**Configuration used**: Organization UI\\n\\n**Review profile**: ASSERTIVE\\n\\n**Plan**: Pro\\n\\n**Run ID**: `1c4faddc-db6d-4c68-a415-559708a4ad5e`\\n\\n

\\n\\n

\\n

📥 Commits

\\n\\nReviewing files that changed from the base of the PR and between 87f394073787aa0a555a5b503ed2ea8e8e911bd5 and 7aafe0c052bdd26913b44c1cb9c65f1c7c2f73ec.\\n\\n

\\n\\n

\\n

📒 Files selected for processing (5)

\\n\\n* `.github/workflows/auto-release-tag.yml`\\n* `.github/workflows/release.yml`\\n* `docs/topics/release-process/policy.toml`\\n* `docs/topics/release-process/runbook.md`\\n* `xtask/src/main.rs`\\n\\n

\\n\\n

\\n

📜 Review details

\\n\\n

\\n

🧰 Additional context used

\\n\\n

\\n

📓 Path-based instructions (1)

\\n\\n

\\n

\\n\\n\\n**⚙️ CodeRabbit configuration file**\\n\\n> `**`: # AGENTS\\n> \\n> ## Git Rules\\n> \\n> NEVER amend git commits. Make a new commit instead.\\n> \\n> NEVER use `git rebase` unless the user explicitly approves a rare exception.\\n> Use regular merge commits.\\n> \\n> NEVER force any git operation. If a force operation appears necessary, stop and\\n> explain what happened and what options remain.\\n> \\n> NEVER create draft pull requests.\\n> \\n> NEVER use a `codex` prefix in branch names, PR titles, or commit messages.\\n> \\n> Pull request bodies for issue work MUST include GitHub auto-close text such as\\n> `Closes `#123`` for every issue the PR is intended to close.\\n> \\n> ## Think\\n> \\n> Think is durable memory for cross-session coordination.\\n> \\n> - Use `codex-think --remember --json` when starting a new session, changing into\\n> this repository, or regaining context after a context shift.\\n> - Use `codex-think \\\"...\\\" --json` when a cycle closes or a significant event\\n> should survive across turns.\\n> - Treat Think as memory, not repo truth. Anchor strong claims back to files,\\n> commits, commands, issues, or pull requests.\\n> - Claude memories are read-only. Use `claude-think --remember --json` only for\\n> additional context.\\n> \\n> ## Topic Shelves\\n> \\n> `docs/topics/` contains the living contract graph for landed behavior. Topic\\n> shelves are not proposals, retrospectives, or design archaeology.\\n> \\n> Each shelf may contain:\\n> \\n> - `README.md`: what is true in HEAD.\\n> - `test-plan.md`: how those truths are verified, including requirements, cases,\\n> fixtures, oracles, implemented evidence, planned cases, and known gaps.\\n> - `architecture.md`: optional structure or dataflow notes when the machinery\\n> earns a separate page.\\n> - `rationale.md`: optional still-relevant tradeoffs and rejected approaches.\\n> \\n> ### When To Update Topic Shelves\\n> \\n> For every nontrivial behavior, contract, workflow, release, schema, validation,\\n> or public-surface change:\\n> \\n> 1. Identify the owning topic shelf before editing code.\\n> 2. If no shelf owns durable behavior, create one.\\n> 3. Update `test-plan.md` before or alongside tests with requirement IDs, case\\n> IDs,...\\n\\nFiles:\\n- `docs/topics/release-process/policy.toml`\\n- `docs/topics/release-process/runbook.md`\\n- `xtask/src/main.rs`\\n\\n

\\n\\n

\\n

🪛 zizmor (1.26.1)

\\n\\n

\\n

.github/workflows/auto-release-tag.yml

\\n\\n[warning] 23-23: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\\n\\n(undocumented-permissions)\\n\\n---\\n\\n[warning] 99-102: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false\\n\\n(artipacked)\\n\\n---\\n\\n[warning] 96-96: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\\n\\n(undocumented-permissions)\\n\\n---\\n\\n[warning] 158-158: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\\n\\n(undocumented-permissions)\\n\\n

\\n\\n

\\n

🔇 Additional comments (3)

\\n\\n
\\n
.github/workflows/auto-release-tag.yml (2)
\\n\\n`10-88`: LGTM!\\n\\n\\n\\n---\\n\\n`150-168`: LGTM!\\n\\n\\n\\n
\\n
\\n
.github/workflows/release.yml (1)
\\n\\n`65-87`: LGTM!\\n\\n\\n\\nAlso applies to: 95-142\\n\\n\\n\\n
\\n\\n

\\n\\n

\\n\\n\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Select the repo when dispatching releases**\\n\\nWhen the auto-release path reaches this job, it has not run `actions/checkout`, so `gh workflow run` has no local Git remote from which to infer the repository. The GitHub CLI docs list `-R/--repo` for `gh workflow run` and say `GH_REPO` specifies the repository for commands that otherwise operate on a local repo; `GH_TOKEN` only authenticates. As written, the job can create the tag successfully and then fail to dispatch `release.yml` unless `GH_REPO: ${{ github.repository }}` or `--repo \\\"${GITHUB_REPOSITORY}\\\"` is provided.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/auto-release-tag.yml\",\"side\":\"RIGHT\",\"line\":173}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P3 Badge](https://img.shields.io/badge/P3-lightgrey?style=flat)}} Query closed milestones in the runbook**\\n\\nIn the post-release verification path, this command is supposed to confirm the milestone was closed, but the GitHub List milestones endpoint defaults `state` to `open` unless `state=closed` or `state=all` is set. After the workflow successfully closes the milestone, this command will return no row, so operators lose the closure evidence the next paragraph asks them to record.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\"docs/topics/release-process/runbook.md\",\"side\":\"RIGHT\",\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Read release notes from the dispatched tag**\\n\\nWhen `workflow_dispatch` is run from `main` with an existing tag input (the natural recovery path after fixing a broken release workflow on `main`), this sets `TAG` to the input but leaves the workspace checked out at the dispatch ref, so `docs/releases/${TAG}.md` and the notes passed to `gh release create` can come from a later commit rather than the immutable tag that was just verified. Either check out the tag or read the notes via the tag object before publishing, otherwise a manual/recovery dispatch can publish release notes that do not match the tagged artifact.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":45}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `7aafe0c052`\\n \\n\\n

ℹ️ About Codex in GitHub

\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"## Self-Discovered Issue\\n\\n@codex second opinion requested.\\n\\n| Severity | Source | File | Lines | Issue | Mitigation |\\n| --- | --- | --- | --- | --- | --- |\\n| P2 | Self | `.github/workflows/auto-release-tag.yml`, `.github/workflows/release.yml` | milestone lookup commands | Paginated milestone lookup pipes through `head -n 1` while the script uses `set -euo pipefail`. If `gh api --paginate` writes additional output after `head` exits, the producer can receive SIGPIPE and the command substitution can fail even when the target milestone exists. | Replace `head`-based truncation with a single jq selection over the paginated stream, and add xtask coverage that milestone lookups do not depend on `head`. |\",\"path\":null,\"side\":null,\"line\":null}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Avoid truncating paginated milestone output with head**\\n\\nWith `set -euo pipefail` enabled, this command substitution can abort even after the milestone was found: `gh api --paginate` continues traversing pages, so if the jq filter emits additional output after `head` exits, the producer can receive SIGPIPE and the whole assignment returns non-zero. In that scenario release publication fails instead of using the matched milestone; the same `| head -n 1` pattern is also present in `.github/workflows/auto-release-tag.yml`, so the lookup should select a single object inside jq/slurped JSON rather than relying on `head`.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":66}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Check out the requested tag before reading notes**\\n\\nWhen this workflow is manually dispatched from the Actions UI or from `gh workflow run` without `--ref` matching `inputs.tag`, the checkout remains on the selected workflow ref (usually `main`) while `RELEASE_TAG` points at the requested tag. The tag target is validated, but `--notes-file docs/releases/${TAG}.md` is then read from the checked-out branch instead of the immutable tag, so a recovery run for an older tag can publish release notes from a later or unrelated commit; check out `RELEASE_TAG` or assert the checked-out commit matches it before using the notes file.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/release.yml\",\"side\":\"RIGHT\",\"line\":37}{\"type\":\"pull_request_comment\",\"body\":\"**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Give gh workflow run an explicit repository**\\n\\nIn this separate dispatch job there is no checkout step and no `GH_REPO`/`-R` repository context, while `gh workflow run` is one of the commands that otherwise operates on the local repository (the gh environment docs call out `GH_REPO` for this case). On the normal auto-release path this fresh job will therefore fail to determine the repository before it can dispatch `release.yml`, leaving the tag created but the GitHub Release unpublished; pass `-R \\\"${GITHUB_REPOSITORY}\\\"` or set `GH_REPO`.\\n\\nUseful? React with 👍 / 👎.\",\"path\":\".github/workflows/auto-release-tag.yml\",\"side\":\"RIGHT\",\"line\":168}{\"type\":\"pull_request_comment\",\"body\":\"\\n### 💡 Codex Review\\n\\nHere are some automated review suggestions for this pull request.\\n\\n**Reviewed commit:** `7aafe0c052`\\n \\n\\n

ℹ️ About Codex in GitHub

\",\"path\":null,\"side\":null,\"line\":null}","text_elements",[],{"_414":676,"_395":396,"_416":402},{"_417":677,"_419":-5,"_42":-5,"_420":-5,"_421":-5,"_96":325,"_92":423},[678],{"_46":672,"_92":679},"input_text",{"_414":681,"_395":396,"_416":402},{"_417":682,"_419":-5,"_42":-5,"_420":-5,"_421":-5,"_96":325,"_92":423},[683,684],{"_46":686,"_92":679},{"_46":685,"_92":679},"\n /workspace/edict\n bash\n 2026-06-25\n Etc/UTC\n","# AGENTS.md instructions for /workspace/edict\n\n\n# AGENTS\n\n## Git Rules\n\nNEVER amend git commits. Make a new commit instead.\n\nNEVER use `git rebase` unless the user explicitly approves a rare exception.\nUse regular merge commits.\n\nNEVER force any git operation. If a force operation appears necessary, stop and\nexplain what happened and what options remain.\n\nNEVER create draft pull requests.\n\nNEVER use a `codex` prefix in branch names, PR titles, or commit messages.\n\nPull request bodies for issue work MUST include GitHub auto-close text such as\n`Closes #123` for every issue the PR is intended to close.\n\n## Think\n\nThink is durable memory for cross-session coordination.\n\n- Use `codex-think --remember --json` when starting a new session, changing into\n this repository, or regaining context after a context shift.\n- Use `codex-think \"...\" --json` when a cycle closes or a significant event\n should survive across turns.\n- Treat Think as memory, not repo truth. Anchor strong claims back to files,\n commits, commands, issues, or pull requests.\n- Claude memories are read-only. Use `claude-think --remember --json` only for\n additional context.\n\n## Topic Shelves\n\n`docs/topics/` contains the living contract graph for landed behavior. Topic\nshelves are not proposals, retrospectives, or design archaeology.\n\nEach shelf may contain:\n\n- `README.md`: what is true in HEAD.\n- `test-plan.md`: how those truths are verified, including requirements, cases,\n fixtures, oracles, implemented evidence, planned cases, and known gaps.\n- `architecture.md`: optional structure or dataflow notes when the machinery\n earns a separate page.\n- `rationale.md`: optional still-relevant tradeoffs and rejected approaches.\n\n### When To Update Topic Shelves\n\nFor every nontrivial behavior, contract, workflow, release, schema, validation,\nor public-surface change:\n\n1. Identify the owning topic shelf before editing code.\n2. If no shelf owns durable behavior, create one.\n3. Update `test-plan.md` before or alongside tests with requirement IDs, case\n IDs, fixtures, and oracles.\n4. Write executable evidence: deterministic tests, fixtures, doctests, or\n contract checks as appropriate.\n5. Update the topic `README.md` only after behavior exists in the branch. The\n README describes current branch truth, not intended future behavior.\n6. Mark planned cases as implemented only when executable evidence exists.\n7. Run `cargo xtask verify` before claiming the shelf is current.\n\n### When Not To Update Topic Shelves\n\nDo not churn topic shelves for purely mechanical edits that do not change a\ncontract, such as formatting, typo fixes, dependency pin updates with no\nobservable behavior change, or internal refactors whose existing tests and topic\nclaims remain accurate.\n\nWhen a change intentionally does not update a topic shelf, state why in the pull\nrequest body or final report.\n\n### Topic Shelf Discipline\n\n- Topic `README.md` files must not describe intended behavior before it lands.\n- `test-plan.md` may include planned cases and known gaps.\n- `policy` rows are for human-review workflow contracts. They must not be used\n to avoid writing behavior tests for software behavior.\n- Tests assert code behavior and stable contract artifacts, not prose.\n- Negative tests should assert stable error kinds or structured artifacts, not\n merely `is_err()` or diagnostic text.\n- Release, CI, and publication workflows count as behavior when they define a\n project contract.\n- Avoid ceremonial documentation. Update shelves because the contract changed,\n not because a path changed.\n\n## RED/GREEN Testing Discipline\n\nEdict uses RED/GREEN test-driven development for nontrivial changes. The shared\ncontract lives in [docs/topics/tests/](docs/topics/tests/README.md).\n\nFor behavior, contract, workflow, release, schema, validation, or public-surface\nchanges:\n\n1. Update the owning topic `test-plan.md` with planned requirement and case rows\n before or alongside the first test.\n2. Write the deterministic test, fixture, doctest, or contract check before the\n implementation that makes it pass.\n3. Run the narrowest relevant command and observe the RED failure.\n4. Implement the smallest coherent change that turns that test GREEN.\n5. Mark planned rows as implemented only after executable evidence exists.\n6. Report the RED command and GREEN command in the final report or pull request\n body.\n\nTests must assert software behavior. Do not write tests that assert\nimplementation detail, documentation detail, or repository structure. Tests may\nexercise documentation tooling behavior, such as a validator rejecting invalid\ninput, but they must not pass merely because prose contains a phrase or a file\nappears at a particular path.\n\nDo not use after-the-fact tests as a substitute for RED/GREEN. If a change is a\npurely mechanical edit with no contract impact, state that no RED/GREEN cycle\nwas required.\n\n## Documentation Standards\n\nDocumentation is a product interface, not a Markdown inventory. The shared\ndocumentation policy lives in\n[docs/topics/documentation/](docs/topics/documentation/README.md).\n\nWhen creating or changing documentation:\n\n- Give each page one primary reader job: tutorial, how-to, reference,\n explanation, troubleshooting, or contributor guidance.\n- Keep user-facing task help separate from contributor architecture and evidence\n maps.\n- Use concrete, valid examples and show expected results when the result matters.\n- Put exact public facts in reference material and validate or generate them\n from authoritative sources when practical.\n- Update affected documentation in the same change as behavior, schema, release,\n workflow, or public-surface changes, or state `docs-impact: none` with a\n concise rationale.\n\n## Local Verification\n\nUse the local gate before claiming a branch is ready:\n\n```text\ncargo xtask verify\n```\n\n",{"_414":688,"_395":396,"_416":402},{"_417":689,"_419":-5,"_42":-5,"_420":-5,"_421":-5,"_96":690,"_92":423},[691,692],"developer",{"_46":694,"_92":679},{"_46":693,"_92":679},"\n## Skills\nA skill is a set of local instructions to follow that is stored in a `SKILL.md` file. Below is the list of skills that can be used. Each entry includes a name, description, and file path so you can open the source for full instructions when using a specific skill.\n### Available skills\n- imagegen: Generate or edit raster images when the task benefits from AI-created bitmap visuals such as photos, illustrations, textures, sprites, mockups, or transparent-background cutouts. Use when Codex should create a brand-new image, transform an existing image, or derive visual variants from references, and the output should be a bitmap asset rather than repo-native code or vector. Do not use when the task is better handled by editing existing SVG/vector/code-native assets, extending an established icon or logo system, or building the visual directly in HTML/CSS/canvas. (file: /opt/codex/skills/.system/imagegen/SKILL.md)\n- openai-docs: Use when the user asks how to build with OpenAI products or APIs and needs up-to-date official documentation with citations, help choosing the latest model for a use case, or model upgrade and prompt-upgrade guidance; prioritize OpenAI docs MCP tools, use bundled references only as helper context, and restrict any fallback browsing to official OpenAI domains. (file: /opt/codex/skills/.system/openai-docs/SKILL.md)\n- plugin-creator: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new local plugin, add optional plugin structure, or generate or update repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata. (file: /opt/codex/skills/.system/plugin-creator/SKILL.md)\n- skill-creator: Guide for creating effective skills. This skill should be used when users want to create a new skill (or update an existing skill) that extends Codex's capabilities with specialized knowledge, workflows, or tool integrations. (file: /opt/codex/skills/.system/skill-creator/SKILL.md)\n- skill-installer: Install Codex skills into $CODEX_HOME/skills from a curated list or a GitHub repo path. Use when a user asks to list installable skills, install a curated skill, or install a skill from another repo (including private repos). (file: /opt/codex/skills/.system/skill-installer/SKILL.md)\n### How to use skills\n- Discovery: The list above is the skills available in this session (name + description + file path). Skill bodies live on disk at the listed paths.\n- Trigger rules: If the user names a skill (with `$SkillName` or plain text) OR the task clearly matches a skill's description shown above, you must use that skill for that turn. Multiple mentions mean use them all. Do not carry skills across turns unless re-mentioned.\n- Missing/blocked: If a named skill isn't in the list or the path can't be read, say so briefly and continue with the best fallback.\n- How to use a skill (progressive disclosure):\n 1) After deciding to use a skill, open its `SKILL.md`. Read only enough to follow the workflow.\n 2) When `SKILL.md` references relative paths (e.g., `scripts/foo.py`), resolve them relative to the skill directory listed above first, and only consider other paths if needed.\n 3) If `SKILL.md` points to extra folders such as `references/`, load only the specific files needed for the request; don't bulk-load everything.\n 4) If `scripts/` exist, prefer running or patching them instead of retyping large code blocks.\n 5) If `assets/` or templates exist, reuse them instead of recreating from scratch.\n- Coordination and sequencing:\n - If multiple skills apply, choose the minimal set that covers the request and state the order you'll use them.\n - Announce which skill(s) you're using and why (one short line). If you skip an obvious skill, say why.\n- Context hygiene:\n - Keep context small: summarize long sections instead of pasting them; only load extra files when needed.\n - Avoid deep reference-chasing: prefer opening only files directly linked from `SKILL.md` unless you're blocked.\n - When variants exist (frameworks, providers, domains), pick only the relevant reference file(s) and note that choice.\n- Safety and fallback: If a skill can't be applied cleanly (missing files, unclear instructions), state the issue, pick the next-best approach, and continue.\n","\nFilesystem sandboxing defines which files can be read or written. `sandbox_mode` is `danger-full-access`: No filesystem sandboxing - all commands are permitted. Network access is enabled.\nApproval policy is currently never. Do not provide the `sandbox_permissions` for any reason, commands will be rejected.\n","turn/started",{"_395":396,"_87":697},{"_103":-5,"_42":402,"_403":698,"_405":406,"_407":699},[],"inProgress",{"_407":701,"_395":396},{"_702":703,"_92":704},"activeFlags",[],"active","thread/started",{"_707":708},"thread",{"_709":-5,"_710":-5,"_711":712,"_713":714,"_462":463,"_715":15,"_716":-5,"_717":-5,"_718":-5,"_719":720,"_42":396,"_721":722,"_181":-5,"_723":-5,"_161":724,"_725":199,"_726":-5,"_467":727,"_407":728,"_729":-5,"_77":730,"_731":714},"agentNickname","agentRole","cliVersion","0.128.0","createdAt",1782415602,"ephemeral","extra","forkedFromId","gitInfo","historyMode","legacy","modelProvider","openai","parentThreadId","/opt/codex/sessions/2026/06/25/rollout-2026-06-25T19-26-42-019f003f-b4a8-7802-90ae-d02234321c68.jsonl","preview","recencyAt","vscode",{"_92":411},"threadSource",[],"updatedAt",[],"messages",[735],{"_42":736,"_737":738,"_739":740,"_741":740,"_417":742,"_407":743,"_419":-5,"_744":32,"_745":746,"_747":748,"_749":-5},"5dec5088-c1b0-4d4f-9c0f-ade9f8354f49","author",{"_96":325,"_181":-5,"_745":758},"create_time",1782415601.608217,"update_time",{"_754":46,"_755":756},"finished_successfully","weight","metadata",{"_750":751},"recipient","all","channel","l1239dk1",{"_752":753},"inline_comments",[],"content_type","parts",[757],"@codex Activity Summary for the latest Code Lawyer pass.\n\n| Source | Severity | File(s) | Commit(s) | Outcome |\n| --- | --- | --- | --- | --- |\n| PR | P2 | `.github/workflows/auto-release-tag.yml`, `xtask/src/main.rs` | `e6ab7cc`, `3e19e44` | Disabled checkout credential persistence and moved tag-job Git network operations to explicit per-command ephemeral auth. |\n| PR | P2 | `.github/workflows/auto-release-tag.yml`, `xtask/src/main.rs` | `71a1f0e` | Added explicit repository context for `gh workflow run` in the dispatch-only job. |\n| PR | P2 | `.github/workflows/release.yml`, `xtask/src/main.rs` | `e4fd041` | Made manual release dispatch check out the tag being published before reading release notes. |\n| PR | P3 | `docs/topics/release-process/runbook.md`, `docs/topics/release-process/policy.toml`, `xtask/src/main.rs` | `922d1c4` | Updated post-release milestone verification to query paginated all-state milestones. |\n| PR | P3 | `xtask/src/main.rs`, `docs/topics/release-process/policy.toml` | `8c7c413` | Bound the pagination regression to the release milestone lookup contract instead of any paginated API call. |\n| PR | P3 | `xtask/src/main.rs`, `docs/topics/release-process/policy.toml` | `091f0a0` | Hardened release permission tests to inspect top-level and job-local permission blocks. |\n| Self | P2 | `.github/workflows/release.yml`, `.github/workflows/auto-release-tag.yml`, `docs/topics/release-process/policy.toml`, `xtask/src/main.rs` | `2cbd99b` | Removed `head`-based paginated milestone selection under `pipefail`; both workflows now consume the full stream before selecting the first match. |\n| Self | P5 | `xtask/src/main.rs` | `ca19915` | Formatter-only cleanup required by `cargo fmt --all --check`. |\n\nValidation run on the final head `3e19e44`:\n\n- `actionlint`\n- `git diff --check origin/main...HEAD`\n- `cargo test -p xtask release_`\n- `cargo xtask verify`\n\nAll previously unresolved PR review threads were resolved via GraphQL after the fixes landed.\nPrepare v0.5.0-alpha.1 release\n\n## Summary\n\nPrepare `v0.5.0-alpha.1` for release and automate the post-merge release path.\n\n## What changed\n\n- Bumped `crates/edict-syntax` and `Cargo.lock` to `0.5.0-alpha.1`.\n- Cut `CHANGELOG.md` entries into the dated `v0.5.0-alpha.1` section.\n- Added `docs/releases/v0.5.0-alpha.1.md` for the Gate C admission-boundary alpha.\n- Refreshed README, docs index, ROADMAP, and release-process topic signposts.\n- Added structured release-process policy and xtask tests for the v0.5 admission boundary.\n- Added `.github/workflows/auto-release-tag.yml` to create immutable release tags after successful `main` CI on merged `release/*-prep` PRs.\n- Extended the Release workflow to support `workflow_dispatch`, verify zero-open matching milestones, publish the GitHub prerelease, and close the matching milestone.\n\n## Validation\n\n- `actionlint`\n- `git diff --check`\n- `cargo test -p xtask release_`\n- `cargo xtask verify`\n\nCloses #42\n\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/flyingrobots/edict/pull/43?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\n\n\n> [!NOTE]\n> Currently processing new changes in this PR. This may take a few minutes, please wait...\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: Organization UI\n> \n> **Review profile**: ASSERTIVE\n> \n> **Plan**: Pro\n> \n> **Run ID**: `d7341a97-9596-41e8-9b7b-c8ab8fd80e15`\n> \n>

\n> \n>

\n>

📥 Commits

\n> \n> Reviewing files that changed from the base of the PR and between 7aafe0c052bdd26913b44c1cb9c65f1c7c2f73ec and ca19915713018576089f4d9c44ed32a2c79d902f.\n> \n>

\n> \n>

\n>

📒 Files selected for processing (5)

\n> \n> * `.github/workflows/auto-release-tag.yml`\n> * `.github/workflows/release.yml`\n> * `docs/topics/release-process/policy.toml`\n> * `docs/topics/release-process/runbook.md`\n> * `xtask/src/main.rs`\n> \n>

\n> \n> ```ascii\n> _______________________________________\n> < `NaN` is not a valid user experience. >\n> ---------------------------------------\n> \\\n> \\ \\\n> \\ /\\\n> ( )\n> .( o ).\n> ```\n\n\n\n\n\n## Walkthrough\nAdds automated release-tag creation after successful main CI, extends release publication to accept manual tags and close milestones, and updates the v0.5.0-alpha.1 release notes, policy/docs/tests, and crate version.\n\n## Changes\n\n**Release automation and v0.5 rollout**\n\n|Layer / File(s)|Summary|\n|---|---|\n|**Auto-release workflow entry**
`.github/workflows/auto-release-tag.yml`|The new workflow runs after successful CI on main, gates on the workflow_run result, and checks out the triggering commit.|\n|**Tag derivation and dispatch**
`.github/workflows/auto-release-tag.yml`|The workflow finds one merged release-prep PR, derives the release tag, verifies the release notes file, creates or verifies the annotated tag, and dispatches `release.yml`.|\n|**Release workflow publication path**
`.github/workflows/release.yml`|`release.yml` accepts a manual tag input, adjusts permissions and concurrency, and validates the selected tag against GitHub milestones before publishing and closing the milestone.|\n|**Release notes document**
`docs/releases/v0.5.0-alpha.1.md`|The new v0.5.0-alpha.1 release notes document defines the release type, included Gate C admission artifacts, non-goals, merge gates, and publication plan.|\n|**Release metadata and surfaced links**
`CHANGELOG.md`, `README.md`, `ROADMAP.md`, `docs/README.md`, `crates/edict-syntax/Cargo.toml`|The changelog, README, roadmap, docs index, and crate version are updated to surface v0.5.0-alpha.1 and the new release issue 42.|\n|**Release-process policy and validation**
`docs/topics/release-process/*`, `xtask/src/main.rs`|The release-process docs, policy, runbook, test plan, and xtask assertions are updated for auto-tagging, manual dispatch, milestone closure, and the v0.5 boundary.|\n\n## Estimated code review effort\n🎯 4 (Complex) | ⏱️ ~60 minutes\n\n## Possibly related PRs\n- [flyingrobots/edict#14](https://github.com/flyingrobots/edict/pull/14) — Also updates the README status and implementation-scope text around the same release progression.\n- [flyingrobots/edict#26](https://github.com/flyingrobots/edict/pull/26) — Also extends `xtask/src/main.rs` checks for release-process workflow and policy structure.\n\n## Poem\n> A tag was born on main’s clean track, \n> Then milestones nodded, no turning back. \n> Notes and gates aligned with care, \n> A prerelease drifts through the air, \n> And tests keep time with a steady spark.\n\n\n\n\n

🚥 Pre-merge checks | ✅ 5

\n\n

✅ Passed checks (5 passed)

\n\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\n\n

\n\n\n\n\n---\n\nThanks for using [CodeRabbit](https://coderabbit.ai?utm_source=oss&utm_medium=github&utm_campaign=flyingrobots/edict&utm_content=43)! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.\n\n

❤️ Share

\n\n- [X](https://twitter.com/intent/tweet?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A&url=https%3A//coderabbit.ai)\n- [Mastodon](https://mastodon.social/share?text=I%20just%20used%20%40coderabbitai%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20the%20proprietary%20code.%20Check%20it%20out%3A%20https%3A%2F%2Fcoderabbit.ai)\n- [Reddit](https://www.reddit.com/submit?title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&text=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code.%20Check%20it%20out%3A%20https%3A//coderabbit.ai)\n- [LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fcoderabbit.ai&mini=true&title=Great%20tool%20for%20code%20review%20-%20CodeRabbit&summary=I%20just%20used%20CodeRabbit%20for%20my%20code%20review%2C%20and%20it%27s%20fantastic%21%20It%27s%20free%20for%20OSS%20and%20offers%20a%20free%20trial%20for%20proprietary%20code)\n\n

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands.}\n\n\n_🔒 Security & Privacy_ | _🟠 Major_\n\n

🧩 Analysis chain

\n\n🏁 Script executed:\n\n```shell\ncat -n .github/workflows/auto-release-tag.yml\n```\n\nRepository: flyingrobots/edict\n\nLength of output: 5007\n\n---\n\n\n\n

\n\n**Split the privileged `workflow_run` job into distinct stages.**\n\nThe current single `tag-release` job inherits excessive `actions: write` and `contents: write` permissions globally. This is unacceptable for a workflow listening to external webhooks.\n\n1. **Isolate Content Writes:** The script identifying the release PR (lines 35–82) only needs `pull-requests: read` and `contents: read`. Currently, it runs with full write access.\n2. **Isolate Tag Creation:** The `git push` operation (line 112) is the *only* step needing `contents: write`. It does not need `actions: write`.\n3. **Isolate Dispatch:** The `gh workflow run` command (line 124) triggers a subsequent workflow. It requires `actions: write` but should not retain `contents: write`.\n\nRefactor into chained jobs (`identify` -> `tag` -> `dispatch`) or use a permission matrix so the `create tag` step does not sit dormant with `actions` privileges. Minimize blast radius for the `workflow_run` trigger.\n\n

🧰 Tools

\n\n

🪛 zizmor (1.26.1)

\n\n[error] 10-10: overly broad permissions (excessive-permissions): actions: write is overly broad at the workflow level\n\n(excessive-permissions)\n\n---\n\n[error] 11-11: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level\n\n(excessive-permissions)\n\n---\n\n[warning] 10-10: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\n\n(undocumented-permissions)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/auto-release-tag.yml around lines 9 - 12, The workflow_run\njob is over-privileged because the single tag-release job currently holds\nactions: write and contents: write for every step. Split the logic in\nauto-release-tag into separate stages or jobs around the existing\nidentify/tag/dispatch flow so the release-PR lookup runs with only\npull-requests: read and contents: read, the git push step in the tag creation\npath gets only contents: write, and the gh workflow run dispatch step gets only\nactions: write; keep the permissions scoped to the specific job or stage names\nused in the current release tagging flow.\n```\n\n

\n\n\n\n\n\n_Source: Linters/SAST tools_\n\n\n\n✅ Addressed in commits 1bbc598 to 7aafe0c\n_🗄️ Data Integrity & Integration_ | _🟠 Major_\n\n**The release gate will catastrophically fail any repository with a history exceeding 100 milestones.**\n\nThe GitHub API enforces pagination. Without the `--paginate` flag, `gh api` returns only the first page. Consequently, if the target milestone resides beyond the 100th record, the lookup returns empty, triggering a spurious `exit 1` that blocks valid releases. This is brittle engineering that ignores the reality of long-lived repositories. The `--paginate` flag is mandatory to traverse the full dataset.\n\n

Required Fix

\n\n```diff\n MILESTONE_JSON=\"$(gh api \"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\" \\\n+ --paginate \\\n --jq \".[] | select(.title == \\\"${TAG}\\\")\")\"\n```\n\n

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/release.yml around lines 65 - 66, The milestone lookup in\nthe release workflow is only querying the first page of GitHub results, so it\ncan miss the target milestone in long-lived repositories. Update the gh api call\nin the release job to use pagination so the milestone search in the\nMILESTONE_JSON assignment traverses all pages before the jq filter runs, keeping\nthe existing TAG-based lookup intact.\n```\n\n

\n\n\n\n\n\n\n\n✅ Addressed in commits 1bbc598 to 7aafe0c\n_🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\n\n**This guard does not prove milestone closure happens after publication.**\n\nThe test only checks for milestone-related substrings. A workflow that moved `Close release milestone` above `Publish GitHub release`, or stopped wiring the close step to `steps.release.outputs.*`, would still pass while violating RELEASE-REQ-013 and the implemented oracle in `docs/topics/release-process/test-plan.md`.\n\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\n\n \n\n

Suggested hardening

\n\n```diff\n fn release_workflow_supports_dispatch_and_milestone_closure() {\n let root = repo_root().expect(\"repo root\");\n let workflow =\n fs::read_to_string(root.join(\".github/workflows/release.yml\")).expect(\"workflow\");\n@@\n for needle in [\n \"workflow_dispatch:\",\n \"RELEASE_TAG:\",\n \"inputs.tag\",\n \"issues: write\",\n \"milestones?state=all\",\n \"OPEN_ISSUES\",\n \"gh release view\",\n \"Close release milestone\",\n \"--method PATCH\",\n \"-f state=closed\",\n ] {\n assert!(\n workflow.contains(needle),\n \"release workflow missing dispatch/milestone guard: {needle}\"\n );\n }\n+\n+ let publish_idx = workflow\n+ .find(\"name: Publish GitHub release\")\n+ .expect(\"publish step must exist\");\n+ let close_idx = workflow\n+ .find(\"name: Close release milestone\")\n+ .expect(\"milestone-close step must exist\");\n+ assert!(\n+ publish_idx < close_idx,\n+ \"milestone must be closed only after release publication\"\n+ );\n+\n+ let close_step = &workflow[close_idx..];\n+ assert!(\n+ close_step.contains(\"steps.release.outputs.milestone_number\")\n+ && close_step.contains(\"steps.release.outputs.milestone_state\"),\n+ \"milestone close step must consume verified milestone outputs\"\n+ );\n }\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n fn release_workflow_supports_dispatch_and_milestone_closure() {\n let root = repo_root().expect(\"repo root\");\n let workflow =\n fs::read_to_string(root.join(\".github/workflows/release.yml\")).expect(\"workflow\");\n for needle in [\n \"workflow_dispatch:\",\n \"RELEASE_TAG:\",\n \"inputs.tag\",\n \"issues: write\",\n \"milestones?state=all\",\n \"OPEN_ISSUES\",\n \"gh release view\",\n \"Close release milestone\",\n \"--method PATCH\",\n \"-f state=closed\",\n ] {\n assert!(\n workflow.contains(needle),\n \"release workflow missing dispatch/milestone guard: {needle}\"\n );\n }\n\n let publish_idx = workflow\n .find(\"name: Publish GitHub release\")\n .expect(\"publish step must exist\");\n let close_idx = workflow\n .find(\"name: Close release milestone\")\n .expect(\"milestone-close step must exist\");\n assert!(\n publish_idx < close_idx,\n \"milestone must be closed only after release publication\"\n );\n\n let close_step = &workflow[close_idx..];\n assert!(\n close_step.contains(\"steps.release.outputs.milestone_number\")\n && close_step.contains(\"steps.release.outputs.milestone_state\"),\n \"milestone close step must consume verified milestone outputs\"\n );\n }\n```\n\n

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@xtask/src/main.rs` around lines 880 - 901, The current guard in\nrelease_workflow_supports_dispatch_and_milestone_closure only checks for\nmilestone-related text, so it can miss ordering and wiring regressions. Harden\nthis test by inspecting the release workflow structure around Publish GitHub\nrelease and Close release milestone, and assert that the close step runs only\nafter the publish step and is driven by steps.release.outputs.* rather than just\nmatching substrings. Use the existing\nrelease_workflow_supports_dispatch_and_milestone_closure test and the\nrelease.yml workflow contract as the target for the behavior check.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits 1bbc598 to 7aafe0c\n_🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\n\n**Assert the `workflow_run.event == 'push'` gate too.**\n\nLine 912 only checks for successful CI. If `.github/workflows/auto-release-tag.yml` lost the `github.event.workflow_run.event == 'push'` predicate, this test would still pass and the auto-tagger could start reacting to non-post-merge CI runs instead of only merged-into-`main` runs.\n\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\n\n \n\n

Suggested fix

\n\n```diff\n for needle in [\n \"workflow_run:\",\n \"workflows: [\\\"CI\\\"]\",\n \"branches: [main]\",\n \"github.event.workflow_run.conclusion == 'success'\",\n+ \"github.event.workflow_run.event == 'push'\",\n \"/commits/${SHA}/pulls\",\n \"^release/v[0-9]+\",\n \"docs/releases/${TAG}.md\",\n \"git tag -a\",\n \"refusing to move\",\n```\n

\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n fn auto_release_tag_workflow_is_guarded() {\n let root = repo_root().expect(\"repo root\");\n let workflow = fs::read_to_string(root.join(\".github/workflows/auto-release-tag.yml\"))\n .expect(\"auto release workflow\");\n for needle in [\n \"workflow_run:\",\n \"workflows: [\\\"CI\\\"]\",\n \"branches: [main]\",\n \"github.event.workflow_run.conclusion == 'success'\",\n \"github.event.workflow_run.event == 'push'\",\n \"/commits/${SHA}/pulls\",\n \"^release/v[0-9]+\",\n \"docs/releases/${TAG}.md\",\n \"git tag -a\",\n \"refusing to move\",\n \"gh workflow run release.yml\",\n \"actions: write\",\n ] {\n assert!(\n workflow.contains(needle),\n \"auto release workflow missing guard/action: {needle}\"\n );\n }\n assert!(\n !workflow.contains(\"--force\"),\n \"auto release workflow must not force any git operation\"\n );\n```\n\n

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@xtask/src/main.rs` around lines 904 - 929, The auto-release workflow guard\ntest is missing coverage for the push-event predicate, so update\nauto_release_tag_workflow_is_guarded in xtask/src/main.rs to also assert the\nworkflow contains github.event.workflow_run.event == 'push'. Keep the existing\nchecks around workflow_run, CI, main, and success, but add the missing guard\nstring so the test fails if the auto-tagger starts reacting to non-merge CI\nruns.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits 1bbc598 to 7aafe0c\n**Actionable comments posted: 4**\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (1)

\n> \n>
\n>
docs/topics/release-process/runbook.md (1)
\n> \n> `103-110`: _🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Anchor the fallback tag to refreshed `main`, not implicit `HEAD`.**\n> \n> Line 103 removes the old “refresh local `main` first” guard, but the fallback still uses `git tag -a ...` with no target. If an operator runs this from a stale checkout or the old `release/...-prep` branch, the tag can land on the wrong commit, and `release.yml` would still accept any older commit that is merely reachable from `origin/main`.\n> \n> As per coding guidelines, “Documentation is a product interface, not a Markdown inventory.”\n> \n> \n> \n>
\n>
Suggested fix
\n> \n> ```diff\n> Manual tagging is now an operator fallback, not the normal path. If automation\n> does not run and the release-prep merge commit has been verified on `main`, the\n> fallback is:\n> \n> ```bash\n> +git switch main\n> +git fetch origin\n> +git merge --ff-only origin/main\n> -git tag -a vX.Y.Z-alpha.N -m \"vX.Y.Z-alpha.N\"\n> +git tag -a vX.Y.Z-alpha.N origin/main -m \"vX.Y.Z-alpha.N\"\n> git push origin vX.Y.Z-alpha.N\n> ```\n> ```\n>
\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@docs/topics/release-process/runbook.md` around lines 103 - 110, The fallback\n> tagging step in the release-process runbook can tag the wrong commit because\n> `git tag -a` is currently using the operator’s implicit `HEAD`. Update the\n> instructions around the manual fallback to first refresh local `main` from\n> `origin/main` (for example via the existing release flow context), then make\n> `git tag -a` explicitly point at `origin/main` so the tag is anchored to the\n> verified commit. Use the existing release-prep fallback section and the `git tag\n> -a` / `git push origin` steps as the place to adjust the guidance.\n> ```\n> \n>
\n> \n> \n> \n> _Source: Coding guidelines_\n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nInline comments:\nIn @.github/workflows/auto-release-tag.yml:\n- Around line 9-12: The workflow_run job is over-privileged because the single\ntag-release job currently holds actions: write and contents: write for every\nstep. Split the logic in auto-release-tag into separate stages or jobs around\nthe existing identify/tag/dispatch flow so the release-PR lookup runs with only\npull-requests: read and contents: read, the git push step in the tag creation\npath gets only contents: write, and the gh workflow run dispatch step gets only\nactions: write; keep the permissions scoped to the specific job or stage names\nused in the current release tagging flow.\n\nIn @.github/workflows/release.yml:\n- Around line 65-66: The milestone lookup in the release workflow is only\nquerying the first page of GitHub results, so it can miss the target milestone\nin long-lived repositories. Update the gh api call in the release job to use\npagination so the milestone search in the MILESTONE_JSON assignment traverses\nall pages before the jq filter runs, keeping the existing TAG-based lookup\nintact.\n\nIn `@xtask/src/main.rs`:\n- Around line 904-929: The auto-release workflow guard test is missing coverage\nfor the push-event predicate, so update auto_release_tag_workflow_is_guarded in\nxtask/src/main.rs to also assert the workflow contains\ngithub.event.workflow_run.event == 'push'. Keep the existing checks around\nworkflow_run, CI, main, and success, but add the missing guard string so the\ntest fails if the auto-tagger starts reacting to non-merge CI runs.\n- Around line 880-901: The current guard in\nrelease_workflow_supports_dispatch_and_milestone_closure only checks for\nmilestone-related text, so it can miss ordering and wiring regressions. Harden\nthis test by inspecting the release workflow structure around Publish GitHub\nrelease and Close release milestone, and assert that the close step runs only\nafter the publish step and is driven by steps.release.outputs.* rather than just\nmatching substrings. Use the existing\nrelease_workflow_supports_dispatch_and_milestone_closure test and the\nrelease.yml workflow contract as the target for the behavior check.\n\n---\n\nOutside diff comments:\nIn `@docs/topics/release-process/runbook.md`:\n- Around line 103-110: The fallback tagging step in the release-process runbook\ncan tag the wrong commit because `git tag -a` is currently using the operator’s\nimplicit `HEAD`. Update the instructions around the manual fallback to first\nrefresh local `main` from `origin/main` (for example via the existing release\nflow context), then make `git tag -a` explicitly point at `origin/main` so the\ntag is anchored to the verified commit. Use the existing release-prep fallback\nsection and the `git tag -a` / `git push origin` steps as the place to adjust\nthe guidance.\n```\n\n

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Organization UI\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `9e7a759d-bc04-4541-bea9-7fa80f31de67`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between dcd5677c3710d0869009d2e82a6da1bf4175cc8a and 87f394073787aa0a555a5b503ed2ea8e8e911bd5.\n\n

\n\n

⛔ Files ignored due to path filters (1)

\n\n* `Cargo.lock` is excluded by `!**/*.lock`\n\n

\n\n

📒 Files selected for processing (13)

\n\n* `.github/workflows/auto-release-tag.yml`\n* `.github/workflows/release.yml`\n* `CHANGELOG.md`\n* `README.md`\n* `ROADMAP.md`\n* `crates/edict-syntax/Cargo.toml`\n* `docs/README.md`\n* `docs/releases/v0.5.0-alpha.1.md`\n* `docs/topics/release-process/README.md`\n* `docs/topics/release-process/policy.toml`\n* `docs/topics/release-process/runbook.md`\n* `docs/topics/release-process/test-plan.md`\n* `xtask/src/main.rs`\n\n

\n\n

📜 Review details

\n\n

🧰 Additional context used

\n\n

📓 Path-based instructions (3)

\n\n

\n\n\n**⚙️ CodeRabbit configuration file**\n\n> `**`: # AGENTS\n> \n> ## Git Rules\n> \n> NEVER amend git commits. Make a new commit instead.\n> \n> NEVER use `git rebase` unless the user explicitly approves a rare exception.\n> Use regular merge commits.\n> \n> NEVER force any git operation. If a force operation appears necessary, stop and\n> explain what happened and what options remain.\n> \n> NEVER create draft pull requests.\n> \n> NEVER use a `codex` prefix in branch names, PR titles, or commit messages.\n> \n> Pull request bodies for issue work MUST include GitHub auto-close text such as\n> `Closes `#123`` for every issue the PR is intended to close.\n> \n> ## Think\n> \n> Think is durable memory for cross-session coordination.\n> \n> - Use `codex-think --remember --json` when starting a new session, changing into\n> this repository, or regaining context after a context shift.\n> - Use `codex-think \"...\" --json` when a cycle closes or a significant event\n> should survive across turns.\n> - Treat Think as memory, not repo truth. Anchor strong claims back to files,\n> commits, commands, issues, or pull requests.\n> - Claude memories are read-only. Use `claude-think --remember --json` only for\n> additional context.\n> \n> ## Topic Shelves\n> \n> `docs/topics/` contains the living contract graph for landed behavior. Topic\n> shelves are not proposals, retrospectives, or design archaeology.\n> \n> Each shelf may contain:\n> \n> - `README.md`: what is true in HEAD.\n> - `test-plan.md`: how those truths are verified, including requirements, cases,\n> fixtures, oracles, implemented evidence, planned cases, and known gaps.\n> - `architecture.md`: optional structure or dataflow notes when the machinery\n> earns a separate page.\n> - `rationale.md`: optional still-relevant tradeoffs and rejected approaches.\n> \n> ### When To Update Topic Shelves\n> \n> For every nontrivial behavior, contract, workflow, release, schema, validation,\n> or public-surface change:\n> \n> 1. Identify the owning topic shelf before editing code.\n> 2. If no shelf owns durable behavior, create one.\n> 3. Update `test-plan.md` before or alongside tests with requirement IDs, case\n> IDs,...\n\nFiles:\n- `crates/edict-syntax/Cargo.toml`\n- `CHANGELOG.md`\n- `docs/releases/v0.5.0-alpha.1.md`\n- `ROADMAP.md`\n- `docs/topics/release-process/README.md`\n- `README.md`\n- `docs/README.md`\n- `docs/topics/release-process/policy.toml`\n- `docs/topics/release-process/runbook.md`\n- `xtask/src/main.rs`\n- `docs/topics/release-process/test-plan.md`\n\n

docs/topics/**/README.md

\n\n\n**📄 CodeRabbit inference engine (AGENTS.md)**\n\n> `docs/topics/**/README.md`: Topic shelf `README.md` files must describe only what is true in HEAD.\n> Update the topic shelf `README.md` only after the behavior exists in the branch; do not describe intended future behavior there.\n> Do not churn topic-shelf README files for purely mechanical edits that do not change a contract.\n\nFiles:\n- `docs/topics/release-process/README.md`\n\n

docs/topics/**/test-plan.md

\n\n\n**📄 CodeRabbit inference engine (AGENTS.md)**\n\n> `docs/topics/**/test-plan.md`: Update a topic shelf `test-plan.md` before or alongside tests with requirement IDs, case IDs, fixtures, oracles, implemented evidence, planned cases, and known gaps.\n> Mark planned cases as implemented only when executable evidence exists.\n> Do not use `policy` rows in topic-shelf test plans to avoid writing behavior tests for software behavior.\n> Negative tests in topic-shelf test plans should assert stable error kinds or structured artifacts, not merely `is_err()` or diagnostic text.\n> For nontrivial behavior, contract, workflow, release, schema, validation, or public-surface changes, update the owning topic `test-plan.md` with planned requirement and case rows before or alongside the first test.\n> Mark planned rows as implemented only after executable evidence exists.\n\nFiles:\n- `docs/topics/release-process/test-plan.md`\n\n

\n\n

🪛 LanguageTool

\n\n

docs/topics/release-process/README.md

\n\n[uncategorized] ~11-~11: The official name of this software platform is spelled with a capital “H”.\nContext: ...Edict publishes GitHub releases through `.github/workflows/release.yml`. A release can b...\n\n(GITHUB)\n\n---\n\n[uncategorized] ~16-~16: The official name of this software platform is spelled with a capital “H”.\nContext: ...p PR merge. When `CI` passes on `main`, `.github/workflows/auto-release-tag.yml` checks ...\n\n(GITHUB)\n\n

docs/topics/release-process/runbook.md

\n\n[uncategorized] ~90-~90: The official name of this software platform is spelled with a capital “H”.\nContext: ...w runs on `main`. If that run succeeds, `.github/workflows/auto-release-tag.yml` checks ...\n\n(GITHUB)\n\n

docs/topics/release-process/test-plan.md

\n\n[uncategorized] ~42-~42: The official name of this software platform is spelled with a capital “H”.\nContext: ... and dispatches release publication. | .github/workflows/auto-release-tag.yml, docs/to...\n\n(GITHUB)\n\n---\n\n[uncategorized] ~43-~43: The official name of this software platform is spelled with a capital “H”.\nContext: ... the milestone has zero open issues. | .github/workflows/release.yml, docs/topics/rele...\n\n(GITHUB)\n\n---\n\n[uncategorized] ~55-~55: The official name of this software platform is spelled with a capital “H”.\nContext: ... full tag name after auto-tagging. | | .github/workflows/auto-release-tag.yml | Succes...\n\n(GITHUB)\n\n---\n\n[uncategorized] ~71-~71: The official name of this software platform is spelled with a capital “H”.\nContext: ...ports_dispatch_and_milestone_closure | .github/workflows/auto-release-tag.yml, .github...\n\n(GITHUB)\n\n---\n\n[uncategorized] ~71-~71: The official name of this software platform is spelled with a capital “H”.\nContext: ...github/workflows/auto-release-tag.yml, .github/workflows/release.yml, docs/topics/rele...\n\n(GITHUB)\n\n

\n\n

🪛 zizmor (1.26.1)

\n\n

.github/workflows/release.yml

\n\n[error] 15-15: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level\n\n(excessive-permissions)\n\n---\n\n[error] 16-16: overly broad permissions (excessive-permissions): issues: write is overly broad at the workflow level\n\n(excessive-permissions)\n\n---\n\n[warning] 15-15: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\n\n(undocumented-permissions)\n\n---\n\n[info] 131-131: code injection via template expansion (template-injection): may expand into attacker-controllable code\n\n(template-injection)\n\n---\n\n[info] 132-132: code injection via template expansion (template-injection): may expand into attacker-controllable code\n\n(template-injection)\n\n

.github/workflows/auto-release-tag.yml

\n\n[warning] 24-27: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false\n\n(artipacked)\n\n---\n\n[error] 10-10: overly broad permissions (excessive-permissions): actions: write is overly broad at the workflow level\n\n(excessive-permissions)\n\n---\n\n[error] 11-11: overly broad permissions (excessive-permissions): contents: write is overly broad at the workflow level\n\n(excessive-permissions)\n\n---\n\n[error] 3-7: use of fundamentally insecure workflow trigger (dangerous-triggers): workflow_run is almost always used insecurely\n\n(dangerous-triggers)\n\n---\n\n[warning] 10-10: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\n\n(undocumented-permissions)\n\n

\n\n

🔇 Additional comments (8)

\n\n
\n
docs/releases/v0.5.0-alpha.1.md (1)
\n\n`1-96`: LGTM!\n\n\n\n
\n
\n
crates/edict-syntax/Cargo.toml (1)
\n\n`3-3`: LGTM!\n\n\n\n
\n
\n
CHANGELOG.md (1)
\n\n`11-12`: LGTM!\n\n\n\n
\n
\n
README.md (1)
\n\n`462-465`: LGTM!\n\n\n\nAlso applies to: 494-495, 514-524\n\n\n\n
\n
\n
ROADMAP.md (1)
\n\n`180-181`: LGTM!\n\n\n\nAlso applies to: 195-195, 247-247\n\n\n\n
\n
\n
docs/README.md (1)
\n\n`16-19`: LGTM!\n\n\n\n
\n
\n
.github/workflows/auto-release-tag.yml (1)
\n\n`29-83`: LGTM!\n\n\n\nAlso applies to: 84-113, 115-124\n\n\n\n
\n
\n
.github/workflows/release.yml (1)
\n\n`7-53`: LGTM!\n\n\n\nAlso applies to: 73-87, 95-123, 124-142\n\n\n\n
\n\n

\n\n

\n\n\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Dispatch releases from the tagged ref**\n\nIn the auto-release path, `gh workflow run --ref main` starts the Release workflow from whatever `main` points at when the dispatch is processed; the gh manual defines `--ref` as the branch or tag containing the workflow version. If another commit lands on `main` after CI succeeded for the release merge but before this dispatch runs, `release.yml` checks out that newer commit and reads `docs/releases/${TAG}.md` from it while publishing the tag created at `SHA`, so the release can use notes or workflow guards that were not on the verified tagged commit. Dispatch the workflow at `${TAG}` or make `release.yml` explicitly check out the tagged SHA for this automated path.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Check the milestone before pushing the immutable tag**\n\nWhen a `release/*-prep` PR is merged while the matching milestone still has open issues, this step creates and pushes the immutable release tag before `release.yml` gets a chance to enforce the zero-open-milestone gate. The later Release run will fail, but the tag is already on a commit that did not pass the release gate, and the documented policy forbids moving or recreating it; run the milestone check before `git tag`/`git push` so a not-ready release does not leave behind an unusable durable tag.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Pin manual fallback to the verified merge commit**\n\nIf automation fails and the operator follows this fallback from their release branch or a stale local `main`, `git tag` tags the current `HEAD`, not necessarily the release-prep merge commit that passed `main` CI. Because the Release workflow only checks that the tag target is reachable from `origin/main`, it would accept an older main ancestor or the PR head from a merge commit, leaving an immutable release tag on the wrong commit; the fallback should fetch `origin/main` and tag the verified merge SHA explicitly.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `87f3940737`\n \n\n

ℹ️ About Codex in GitHub

\n
\n\n[Your team has set up Codex to review pull requests in this repo](https://chatgpt.com/codex/cloud/settings/general). Reviews are triggered when you\n- Open a pull request for review\n- Mark a draft as ready\n- Comment \"@codex review\".\n\nIf Codex has suggestions, it will comment; otherwise it will react with 👍.\n\n\n\n\nCodex can also answer questions or update the PR. Try commenting \"@codex address that feedback\".\n \n

\n## Activity Summary\n\n@codex second opinion requested on the resolved review queue.\n\n| # | Severity | Source | File | Commit | Outcome |\n| --- | --- | --- | --- | --- | --- |\n| 1 | P2 | PR | `.github/workflows/auto-release-tag.yml` | `1bbc598` | Split auto-release into scoped identify/tag/dispatch jobs with least privilege. |\n| 2 | P2 | PR | `.github/workflows/auto-release-tag.yml` | `3d6f79d` | Checked matching milestone and zero open issues before creating immutable tags. |\n| 3 | P2 | PR | `.github/workflows/auto-release-tag.yml` | `4699430` | Dispatches `release.yml` from the created tag ref instead of moving `main`. |\n| 4 | P2 | PR | `docs/topics/release-process/runbook.md` | `d4ef31e` | Manual fallback now tags an explicit verified main merge commit. |\n| 5 | P2 | PR | `.github/workflows/release.yml` | `e646f5f` | Release milestone lookup now paginates all milestone pages. |\n| 6 | P3 | PR | `xtask/src/main.rs` | `01fe756` | Release workflow test now asserts publish-before-milestone-close ordering and output wiring. |\n| 7 | P3 | PR | `xtask/src/main.rs` | `8c9f779` | Auto-release test and policy now assert the `workflow_run.event == 'push'` guard. |\n| 8 | P5 | Verify | `xtask/src/main.rs` | `7aafe0c` | Applied required `cargo fmt` formatting follow-up without amending prior commits. |\n\nValidation:\n\n- `actionlint`\n- `git diff --check origin/main...HEAD`\n- `cargo test -p xtask release_`\n- `cargo xtask verify`\n\nAll previously unresolved review threads were resolved via GraphQL after the fixes were pushed.\n_🔒 Security & Privacy_ | _🟠 Major_\n\n**Kill the persisted `contents: write` suicide pact immediately; harden with `persist-credentials: false` and explicit ephemeral auth.**\n\nThe `actions/checkout` action defaults to `persist-credentials: true`, which scrawls your elevated `GITHUB_TOKEN` directly into the runner's local git config. While the `auto-release-tag.yml` workflow currently restricts scope to a single job, leaving a write-token on the workspace disk is negligence. It transforms a controlled network operation into a persistent filesystem liability.\n\nSanitize the checkout at **Lines 99–102** to strip credential persistence:\n\n```diff\n - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\n with:\n ref: ${{ needs.identify-release-pr.outputs.sha }}\n fetch-depth: 0\n+ persist-credentials: false\n```\n\nUpdate the **`Create immutable release tag`** step (Lines 132–147) to inject authentication strictly on a per-command basis:\n\n1. Pass the bearer token via `git -c` for `ls-remote`, `fetch`, and `push`.\n2. Do **not** rely on the runner's cached credentials.\n\nThe token lives only in the runner's memory for the exact duration of the network call. Execute immediately.\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🧰 Tools

\n\n

🪛 zizmor (1.26.1)

\n\n[warning] 99-102: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false\n\n(artipacked)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/auto-release-tag.yml around lines 99 - 102, The checkout\nin the auto-release tagging workflow is persisting write credentials on disk, so\nupdate the existing actions/checkout step to disable credential persistence with\npersist-credentials: false. Then harden the Create immutable release tag step by\nremoving any reliance on cached git auth and using explicit per-command\nauthentication for the git ls-remote, fetch, and push operations, referring to\nthe checkout and release-tagging logic so the token is only used transiently in\neach command.\n```\n\n

\n\n\n\n\n\n\n_📐 Maintainability & Code Quality_ | _🟠 Major_ | _⚡ Quick win_\n\n**Bind the pagination check to the milestone lookup, not any random API call.**\n\nLine 931 only proves `release.yml` contains some `gh api --paginate`. An unrelated paginated call would satisfy this while milestone lookup silently regressed back to a single page.\n\n

Suggested hardening

\n\n```diff\n #[test]\n fn release_workflow_paginates_milestone_lookup() {\n let root = repo_root().expect(\"repo root\");\n let workflow =\n fs::read_to_string(root.join(\".github/workflows/release.yml\")).expect(\"workflow\");\n assert!(\n- workflow.contains(\"gh api --paginate\"),\n- \"release workflow must paginate milestone lookup\"\n+ workflow.contains(\n+ r#\"gh api --paginate \"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\"\"#\n+ ),\n+ \"release workflow must paginate the milestone lookup itself\"\n );\n }\n```\n

\n\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@xtask/src/main.rs` around lines 925 - 933, The release workflow test is too\nbroad because release_workflow_paginates_milestone_lookup only checks for any gh\napi --paginate usage instead of the milestone lookup specifically. Tighten the\nassertion in xtask/src/main.rs so it matches the milestone lookup command in\nrelease.yml, using the existing release_workflow_paginates_milestone_lookup test\nand workflow content to verify the paginated call is tied to milestone retrieval\nrather than any unrelated API call.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits e6ab7cc to ca19915\n_🔒 Security & Privacy_ | _🟠 Major_ | _⚡ Quick win_\n\n**These permission checks do not prove job-local least privilege.**\n\nThis test only checks that the file mentions the job names and permission strings somewhere. It still passes if `actions: write` or `contents: write` moves to a broader scope, which is exactly the regression this guard is supposed to catch.\n\n

Suggested hardening

\n\n```diff\n #[test]\n fn auto_release_tag_workflow_scopes_job_permissions() {\n let root = repo_root().expect(\"repo root\");\n let workflow = fs::read_to_string(root.join(\".github/workflows/auto-release-tag.yml\"))\n .expect(\"auto release workflow\");\n- for required in [\n- \"identify-release-pr:\",\n- \"contents: read\",\n- \"pull-requests: read\",\n- \"create-release-tag:\",\n- \"contents: write\",\n- \"dispatch-release-publication:\",\n- \"actions: write\",\n- ] {\n- assert!(\n- workflow.contains(required),\n- \"auto release workflow missing scoped job permission contract: {required}\"\n- );\n- }\n+ let identify_start = workflow\n+ .find(\"identify-release-pr:\")\n+ .expect(\"identify-release-pr job must exist\");\n+ let create_start = workflow\n+ .find(\"create-release-tag:\")\n+ .expect(\"create-release-tag job must exist\");\n+ let dispatch_start = workflow\n+ .find(\"dispatch-release-publication:\")\n+ .expect(\"dispatch-release-publication job must exist\");\n+\n+ let identify_job = &workflow[identify_start..create_start];\n+ let create_job = &workflow[create_start..dispatch_start];\n+ let dispatch_job = &workflow[dispatch_start..];\n+\n+ assert!(\n+ identify_job.contains(\"contents: read\")\n+ && identify_job.contains(\"pull-requests: read\"),\n+ \"identify-release-pr must stay read-only\"\n+ );\n+ assert!(\n+ create_job.contains(\"contents: write\"),\n+ \"create-release-tag must retain tag-write permission\"\n+ );\n+ assert!(\n+ dispatch_job.contains(\"actions: write\"),\n+ \"dispatch-release-publication must retain workflow-dispatch permission\"\n+ );\n }\n```\n

\n\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n fn auto_release_tag_workflow_scopes_job_permissions() {\n let root = repo_root().expect(\"repo root\");\n let workflow = fs::read_to_string(root.join(\".github/workflows/auto-release-tag.yml\"))\n .expect(\"auto release workflow\");\n let identify_start = workflow\n .find(\"identify-release-pr:\")\n .expect(\"identify-release-pr job must exist\");\n let create_start = workflow\n .find(\"create-release-tag:\")\n .expect(\"create-release-tag job must exist\");\n let dispatch_start = workflow\n .find(\"dispatch-release-publication:\")\n .expect(\"dispatch-release-publication job must exist\");\n\n let identify_job = &workflow[identify_start..create_start];\n let create_job = &workflow[create_start..dispatch_start];\n let dispatch_job = &workflow[dispatch_start..];\n\n assert!(\n identify_job.contains(\"contents: read\")\n && identify_job.contains(\"pull-requests: read\"),\n \"identify-release-pr must stay read-only\"\n );\n assert!(\n create_job.contains(\"contents: write\"),\n \"create-release-tag must retain tag-write permission\"\n );\n assert!(\n dispatch_job.contains(\"actions: write\"),\n \"dispatch-release-publication must retain workflow-dispatch permission\"\n );\n }\n```\n\n

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@xtask/src/main.rs` around lines 973 - 990, The auto-release workflow\npermission test is too weak because it only checks for strings anywhere in the\nYAML, so it can miss permissions leaking to a broader scope. Update\nauto_release_tag_workflow_scopes_job_permissions to parse and inspect the\nworkflow structure for the specific job entries identify-release-pr,\ncreate-release-tag, and dispatch-release-publication, and assert their job-local\npermissions exactly match the expected scoped values rather than just containing\nthe text. Use the existing workflow-loading logic in xtask/src/main.rs to locate\nthe job definitions and verify the permissions map for each job.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits e6ab7cc to ca19915\n**Actionable comments posted: 3**\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (2)

\n> \n>
\n>
docs/topics/release-process/runbook.md (1)
\n> \n> `134-139`: _🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Use the real milestone query contract here.**\n> \n> This command is wrong for the post-release state it asks operators to verify. Without `state=all`, it will usually return nothing once the workflow has closed the milestone, and without pagination it can miss older milestones entirely. Match the workflow’s query instead.\n> \n>
\n>
Suggested fix
\n> \n> ```diff\n> -gh api repos/flyingrobots/edict/milestones --jq \\\n> - '.[] | select(.title == \"vX.Y.Z-alpha.N\") | {title,state,open_issues}'\n> +gh api --paginate \"repos/flyingrobots/edict/milestones?state=all&per_page=100\" --jq \\\n> + '.[] | select(.title == \"vX.Y.Z-alpha.N\") | {title,state,open_issues}'\n> ```\n>
\n> \n> As per coding guidelines, documentation is a product interface, not a Markdown inventory.\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@docs/topics/release-process/runbook.md` around lines 134 - 139, The milestone\n> verification command uses the wrong API contract for the post-release state;\n> update the runbook’s gh api query to match the workflow’s real milestone lookup\n> by requesting all states and handling pagination, then filter for the target\n> milestone title and closed/zero-open-issues result. Locate the command under the\n> release-process runbook near the milestone check, and make sure the documented\n> query aligns with the same contract used by the release workflow so operators\n> can still find closed milestones after release.\n> ```\n> \n>
\n> \n> \n> \n> _Source: Coding guidelines_\n> \n>
\n>
\n>
.github/workflows/release.yml (1)
\n> \n> `37-47`: _🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Check out the selected tag before reading release artifacts.**\n> \n> For `workflow_dispatch`, `RELEASE_TAG` comes from `inputs.tag`, but the workspace remains the manually selected dispatch ref. That can publish `docs/releases/${TAG}.md` from `main` or another branch instead of the immutable tag being released.\n> \n> \n> \n> \n> \n>
\n>
Proposed fix
\n> \n> ```diff\n> TAG=\"${RELEASE_TAG}\"\n> VERSION=\"${TAG#v}\"\n> - NOTES=\"docs/releases/${TAG}.md\"\n> - TAG_COMMIT=\"$(git rev-parse \"${TAG}^{commit}\")\"\n> \n> if [[ ! \"${TAG}\" =~ ^v[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then\n> echo \"::error::Release tag must look like a SemVer v* tag: ${TAG}\"\n> exit 1\n> fi\n> +\n> + TAG_COMMIT=\"$(git rev-parse \"${TAG}^{commit}\")\"\n> @@\n> if ! git merge-base --is-ancestor \"${TAG_COMMIT}\" origin/main; then\n> echo \"::error::Release tags must target commits reachable from origin/main.\"\n> echo \"::error::Tag ${TAG} targets ${TAG_COMMIT}, which is not on origin/main.\"\n> exit 1\n> fi\n> +\n> + git checkout --detach \"${TAG_COMMIT}\"\n> + NOTES=\"docs/releases/${TAG}.md\"\n> ```\n> \n>
\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In @.github/workflows/release.yml around lines 37 - 47, The release workflow\n> reads release notes from the current workspace, but when RELEASE_TAG comes from\n> inputs.tag in workflow_dispatch it may still be on the dispatch ref instead of\n> the immutable tag. Update the release job so the checked-out revision matches\n> TAG before using NOTES or TAG_COMMIT, and keep the logic centered around\n> RELEASE_TAG, TAG, and TAG_COMMIT in the release shell step.\n> ```\n> \n>
\n> \n> \n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nInline comments:\nIn @.github/workflows/auto-release-tag.yml:\n- Around line 99-102: The checkout in the auto-release tagging workflow is\npersisting write credentials on disk, so update the existing actions/checkout\nstep to disable credential persistence with persist-credentials: false. Then\nharden the Create immutable release tag step by removing any reliance on cached\ngit auth and using explicit per-command authentication for the git ls-remote,\nfetch, and push operations, referring to the checkout and release-tagging logic\nso the token is only used transiently in each command.\n\nIn `@xtask/src/main.rs`:\n- Around line 925-933: The release workflow test is too broad because\nrelease_workflow_paginates_milestone_lookup only checks for any gh api\n--paginate usage instead of the milestone lookup specifically. Tighten the\nassertion in xtask/src/main.rs so it matches the milestone lookup command in\nrelease.yml, using the existing release_workflow_paginates_milestone_lookup test\nand workflow content to verify the paginated call is tied to milestone retrieval\nrather than any unrelated API call.\n- Around line 973-990: The auto-release workflow permission test is too weak\nbecause it only checks for strings anywhere in the YAML, so it can miss\npermissions leaking to a broader scope. Update\nauto_release_tag_workflow_scopes_job_permissions to parse and inspect the\nworkflow structure for the specific job entries identify-release-pr,\ncreate-release-tag, and dispatch-release-publication, and assert their job-local\npermissions exactly match the expected scoped values rather than just containing\nthe text. Use the existing workflow-loading logic in xtask/src/main.rs to locate\nthe job definitions and verify the permissions map for each job.\n\n---\n\nOutside diff comments:\nIn @.github/workflows/release.yml:\n- Around line 37-47: The release workflow reads release notes from the current\nworkspace, but when RELEASE_TAG comes from inputs.tag in workflow_dispatch it\nmay still be on the dispatch ref instead of the immutable tag. Update the\nrelease job so the checked-out revision matches TAG before using NOTES or\nTAG_COMMIT, and keep the logic centered around RELEASE_TAG, TAG, and TAG_COMMIT\nin the release shell step.\n\nIn `@docs/topics/release-process/runbook.md`:\n- Around line 134-139: The milestone verification command uses the wrong API\ncontract for the post-release state; update the runbook’s gh api query to match\nthe workflow’s real milestone lookup by requesting all states and handling\npagination, then filter for the target milestone title and\nclosed/zero-open-issues result. Locate the command under the release-process\nrunbook near the milestone check, and make sure the documented query aligns with\nthe same contract used by the release workflow so operators can still find\nclosed milestones after release.\n```\n\n

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Organization UI\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `1c4faddc-db6d-4c68-a415-559708a4ad5e`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between 87f394073787aa0a555a5b503ed2ea8e8e911bd5 and 7aafe0c052bdd26913b44c1cb9c65f1c7c2f73ec.\n\n

\n\n

📒 Files selected for processing (5)

\n\n* `.github/workflows/auto-release-tag.yml`\n* `.github/workflows/release.yml`\n* `docs/topics/release-process/policy.toml`\n* `docs/topics/release-process/runbook.md`\n* `xtask/src/main.rs`\n\n

\n\n

📜 Review details

\n\n

🧰 Additional context used

\n\n

📓 Path-based instructions (1)

\n\n

\n\n\n**⚙️ CodeRabbit configuration file**\n\n> `**`: # AGENTS\n> \n> ## Git Rules\n> \n> NEVER amend git commits. Make a new commit instead.\n> \n> NEVER use `git rebase` unless the user explicitly approves a rare exception.\n> Use regular merge commits.\n> \n> NEVER force any git operation. If a force operation appears necessary, stop and\n> explain what happened and what options remain.\n> \n> NEVER create draft pull requests.\n> \n> NEVER use a `codex` prefix in branch names, PR titles, or commit messages.\n> \n> Pull request bodies for issue work MUST include GitHub auto-close text such as\n> `Closes `#123`` for every issue the PR is intended to close.\n> \n> ## Think\n> \n> Think is durable memory for cross-session coordination.\n> \n> - Use `codex-think --remember --json` when starting a new session, changing into\n> this repository, or regaining context after a context shift.\n> - Use `codex-think \"...\" --json` when a cycle closes or a significant event\n> should survive across turns.\n> - Treat Think as memory, not repo truth. Anchor strong claims back to files,\n> commits, commands, issues, or pull requests.\n> - Claude memories are read-only. Use `claude-think --remember --json` only for\n> additional context.\n> \n> ## Topic Shelves\n> \n> `docs/topics/` contains the living contract graph for landed behavior. Topic\n> shelves are not proposals, retrospectives, or design archaeology.\n> \n> Each shelf may contain:\n> \n> - `README.md`: what is true in HEAD.\n> - `test-plan.md`: how those truths are verified, including requirements, cases,\n> fixtures, oracles, implemented evidence, planned cases, and known gaps.\n> - `architecture.md`: optional structure or dataflow notes when the machinery\n> earns a separate page.\n> - `rationale.md`: optional still-relevant tradeoffs and rejected approaches.\n> \n> ### When To Update Topic Shelves\n> \n> For every nontrivial behavior, contract, workflow, release, schema, validation,\n> or public-surface change:\n> \n> 1. Identify the owning topic shelf before editing code.\n> 2. If no shelf owns durable behavior, create one.\n> 3. Update `test-plan.md` before or alongside tests with requirement IDs, case\n> IDs,...\n\nFiles:\n- `docs/topics/release-process/policy.toml`\n- `docs/topics/release-process/runbook.md`\n- `xtask/src/main.rs`\n\n

\n\n

🪛 zizmor (1.26.1)

\n\n

.github/workflows/auto-release-tag.yml

\n\n[warning] 23-23: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\n\n(undocumented-permissions)\n\n---\n\n[warning] 99-102: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false\n\n(artipacked)\n\n---\n\n[warning] 96-96: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\n\n(undocumented-permissions)\n\n---\n\n[warning] 158-158: permissions without explanatory comments (undocumented-permissions): needs an explanatory comment\n\n(undocumented-permissions)\n\n

\n\n

🔇 Additional comments (3)

\n\n
\n
.github/workflows/auto-release-tag.yml (2)
\n\n`10-88`: LGTM!\n\n\n\n---\n\n`150-168`: LGTM!\n\n\n\n
\n
\n
.github/workflows/release.yml (1)
\n\n`65-87`: LGTM!\n\n\n\nAlso applies to: 95-142\n\n\n\n
\n\n

\n\n

\n\n\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Select the repo when dispatching releases**\n\nWhen the auto-release path reaches this job, it has not run `actions/checkout`, so `gh workflow run` has no local Git remote from which to infer the repository. The GitHub CLI docs list `-R/--repo` for `gh workflow run` and say `GH_REPO` specifies the repository for commands that otherwise operate on a local repo; `GH_TOKEN` only authenticates. As written, the job can create the tag successfully and then fail to dispatch `release.yml` unless `GH_REPO: ${{ github.repository }}` or `--repo \"${GITHUB_REPOSITORY}\"` is provided.\n\nUseful? React with 👍 / 👎.\n**_{_{![P3 Badge](https://img.shields.io/badge/P3-lightgrey?style=flat)}} Query closed milestones in the runbook**\n\nIn the post-release verification path, this command is supposed to confirm the milestone was closed, but the GitHub List milestones endpoint defaults `state` to `open` unless `state=closed` or `state=all` is set. After the workflow successfully closes the milestone, this command will return no row, so operators lose the closure evidence the next paragraph asks them to record.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Read release notes from the dispatched tag**\n\nWhen `workflow_dispatch` is run from `main` with an existing tag input (the natural recovery path after fixing a broken release workflow on `main`), this sets `TAG` to the input but leaves the workspace checked out at the dispatch ref, so `docs/releases/${TAG}.md` and the notes passed to `gh release create` can come from a later commit rather than the immutable tag that was just verified. Either check out the tag or read the notes via the tag object before publishing, otherwise a manual/recovery dispatch can publish release notes that do not match the tagged artifact.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `7aafe0c052`\n \n\n

ℹ️ About Codex in GitHub

\n## Self-Discovered Issue\n\n@codex second opinion requested.\n\n| Severity | Source | File | Lines | Issue | Mitigation |\n| --- | --- | --- | --- | --- | --- |\n| P2 | Self | `.github/workflows/auto-release-tag.yml`, `.github/workflows/release.yml` | milestone lookup commands | Paginated milestone lookup pipes through `head -n 1` while the script uses `set -euo pipefail`. If `gh api --paginate` writes additional output after `head` exits, the producer can receive SIGPIPE and the command substitution can fail even when the target milestone exists. | Replace `head`-based truncation with a single jq selection over the paginated stream, and add xtask coverage that milestone lookups do not depend on `head`. |\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Avoid truncating paginated milestone output with head**\n\nWith `set -euo pipefail` enabled, this command substitution can abort even after the milestone was found: `gh api --paginate` continues traversing pages, so if the jq filter emits additional output after `head` exits, the producer can receive SIGPIPE and the whole assignment returns non-zero. In that scenario release publication fails instead of using the matched milestone; the same `| head -n 1` pattern is also present in `.github/workflows/auto-release-tag.yml`, so the lookup should select a single object inside jq/slurped JSON rather than relying on `head`.\n\nUseful? React with 👍 / 👎.\n**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Check out the requested tag before reading notes**\n\nWhen this workflow is manually dispatched from the Actions UI or from `gh workflow run` without `--ref` matching `inputs.tag`, the checkout remains on the selected workflow ref (usually `main`) while `RELEASE_TAG` points at the requested tag. The tag target is validated, but `--notes-file docs/releases/${TAG}.md` is then read from the checked-out branch instead of the immutable tag, so a recovery run for an older tag can publish release notes from a later or unrelated commit; check out `RELEASE_TAG` or assert the checked-out commit matches it before using the notes file.\n\nUseful? React with 👍 / 👎.\n**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Give gh workflow run an explicit repository**\n\nIn this separate dispatch job there is no checkout step and no `GH_REPO`/`-R` repository context, while `gh workflow run` is one of the commands that otherwise operates on the local repository (the gh environment docs call out `GH_REPO` for this case). On the normal auto-release path this fresh job will therefore fail to determine the repository before it can dispatch `release.yml`, leaving the tag created but the GitHub Release unpublished; pass `-R \"${GITHUB_REPOSITORY}\"` or set `GH_REPO`.\n\nUseful? React with 👍 / 👎.\n\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `7aafe0c052`\n \n\n

ℹ️ About Codex in GitHub

",{},"created",1782415667.7236953,"Completing the task","event_type","info",{"_92":423,"_96":93,"_417":1968},{"_92":766,"_767":768},"partial_repo_snapshot","files",[769,770,771,772],{"_161":1883,"_774":-5,"_775":1884,"_777":-5},{"_161":1781,"_774":-5,"_775":1782,"_777":-5},{"_161":876,"_774":-5,"_775":877,"_777":-5},{"_161":773,"_774":-5,"_775":776,"_777":-5},"docs/topics/release-process/runbook.md","contents","line_range_contents",[778],"missing_reason",{"_779":780,"_781":782,"_417":783,"_784":59},"line_range_start",1,"line_range_end",156,[785,199,786,199,787,788,789,790,791,199,792,199,793,199,794,795,796,797,798,799,796,800,199,801,199,794,802,800,199,803,804,805,199,806,199,807,199,808,809,810,811,812,813,814,815,816,199,817,818,819,820,199,821,199,822,199,794,504,800,199,823,199,794,824,800,199,825,826,199,827,199,828,829,199,830,831,800,199,832,199,794,833,800,199,834,835,199,836,199,837,838,839,840,841,199,830,842,800,199,843,844,199,845,846,847,199,794,848,849,850,851,852,800,199,853,854,199,855,199,856,199,794,857,858,859,800,199,860,199,794,861,800,199,862,199,794,863,864,800,199,865,866,199,867,199,868,869,199,870,199,871,872,873,874,199,875],"contains_end_of_file","# Release Runbook","Status: current operator runbook for alpha releases.","Use this runbook for every Edict alpha release until the process is replaced by","an executable release-preflight command. The structured policy fields in","[`policy.toml`](./policy.toml) are the machine-checkable guardrail; this page is","the human execution path. Normal release publication is automated after a","release-prep pull request merges and `main` CI succeeds.","## 1. Prepare The Branch","Start from a clean, up-to-date `main`:","```bash","export GH_PAGER=cat","git status --porcelain","git switch main","git fetch origin","git merge --ff-only origin/main","```","Create a release-prep branch named for the release:","git switch -c release/vX.Y.Z-alpha.N-prep","Open or identify the release-prep issue in the matching GitHub milestone. The","issue must name the release scope, documentation updates, local gate, CI gate,","and milestone closure requirement.","## 2. Refresh Release Artifacts","Update these artifacts together:","- crate/package version metadata;","- `CHANGELOG.md`;","- `docs/releases/vX.Y.Z-alpha.N.md`;","- `docs/README.md`;","- `README.md`, when its current-status signposts change;","- `ROADMAP.md`, when issue or milestone status changed;","- `docs/topics/release-process/README.md`;","- `docs/topics/release-process/test-plan.md`;","- topic shelves that own newly landed behavior.","Each release notes file must state the release type, version policy, included","scope, explicit non-goals, required verification, and tagging plan. Do not claim","target lowering, admission, bundle integrity, or publication behavior before the","owning topic shelf and tests exist.","## 3. Verify Locally","Run the focused release checks first when the release process changed:","Then run the full local gate:","cargo xtask verify","Fix failures on the branch. Do not tag from a branch that has not passed the","local gate.","## 4. Open And Merge The Release-Prep PR","Push the branch and open a normal pull request against `main`. The PR body must","include GitHub auto-close text for the release-prep issue, for example:","```text","Closes #35","Before merge, verify:","gh pr checks --watch","Merge only when CI is green, required reviews are satisfied, and there are no","unresolved blocking review threads.","## 5. Let Automation Tag From Main","After the PR merges, the `CI` workflow runs on `main`. If that run succeeds,","`.github/workflows/auto-release-tag.yml` checks whether the merge commit came","from a merged `release/vX.Y.Z-alpha.N-prep` pull request. Matching release-prep","branches are converted to tags by stripping the `release/` prefix and `-prep`","suffix:","release/vX.Y.Z-alpha.N-prep -> vX.Y.Z-alpha.N","The automation creates the annotated tag on the verified `main` commit, refuses","to move an existing tag, and dispatches the Release workflow with the tag.","Manual tagging is now an operator fallback, not the normal path. If automation","does not run and the release-prep merge commit has been verified on `main`, the","fallback is to tag that exact verified merge commit:","git fetch origin main:refs/remotes/origin/main --tags","RELEASE_COMMIT=","git merge-base --is-ancestor \"${RELEASE_COMMIT}\" origin/main","git tag -a vX.Y.Z-alpha.N \"${RELEASE_COMMIT}\" -m \"vX.Y.Z-alpha.N\"","git push origin vX.Y.Z-alpha.N","The release workflow rejects tags whose target commit is not reachable from","`origin/main`.","## 6. Watch Publication","Find and watch the release workflow run:","gh run list --workflow \"Auto Release Tag\" --limit 5","gh run list --workflow Release --limit 5","gh run watch ","Confirm the GitHub Release exists:","gh release view vX.Y.Z-alpha.N","Confirm the matching milestone is closed when it has zero open issues:","gh api --paginate 'repos/flyingrobots/edict/milestones?state=all&per_page=100' --jq \\"," '.[] | select(.title == \"vX.Y.Z-alpha.N\") | {title,state,open_issues}'","Record the release URL, tag object or target commit, workflow run, release","issue, and milestone closure evidence in the final release report.","## 7. Recover Without Tag Mutation","Release tags are durable once pushed. If a workflow fails after a valid tag is","pushed, do not move, delete, recreate, or force-push the tag.","Allowed recovery paths:","- fix the workflow on `main` and publish against the existing valid tag;","- manually publish the GitHub Release against the existing valid tag when the"," workflow failure is historical and the checked-in release notes are correct;","- document the failed run and successful recovery evidence.","The recovery policy is structured in [`policy.toml`](./policy.toml).","xtask/src/main.rs",[878],{"_779":780,"_781":879,"_417":880,"_784":59},1559,[881,882,199,883,884,885,886,887,888,199,889,890,891,892,199,893,894,895,896,897,898,899,900,901,199,902,903,904,905,906,907,908,909,910,911,912,913,914,915,899,916,917,918,900,901,199,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,921,922,923,935,933,936,937,938,939,940,901,199,941,942,943,944,945,946,947,948,949,950,951,952,900,901,199,953,954,901,199,955,956,957,958,959,960,899,900,961,901,199,962,963,964,946,965,966,947,967,968,901,199,969,970,971,972,973,974,199,975,976,977,978,900,979,980,900,199,981,982,983,984,900,199,985,940,901,199,986,987,988,989,901,199,990,991,992,993,994,901,199,995,996,997,998,999,199,1000,1001,1002,900,1003,1004,1005,1006,1007,1008,899,1009,940,901,199,1010,1011,1012,1013,1014,1015,1016,1017,1018,1019,1020,1021,1022,1023,199,1024,1025,1026,1027,899,1028,1029,1030,899,900,940,901,199,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,901,199,1042,1043,1044,1045,950,951,1046,1047,1048,1049,900,901,199,1050,1051,1052,900,1053,901,199,1054,1011,1055,1056,1057,1014,1058,1059,1060,1061,199,1062,1063,1064,1065,900,1066,1067,900,199,1068,1069,1070,1071,199,1072,1073,1074,899,1075,900,199,1076,1077,1078,1079,1080,1081,1082,914,1083,899,1084,1085,899,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1090,1099,1100,1090,914,1101,1102,899,1103,1104,1105,914,899,900,199,1072,1106,1107,899,1108,1109,1110,1111,899,900,199,1112,1113,1114,1115,1116,1117,1118,899,1119,1120,899,900,199,1121,940,901,199,1122,1123,901,199,1124,1125,1126,1127,1128,1129,1130,914,1131,1132,1133,1134,911,1135,1136,914,899,900,1137,901,199,1138,1125,1126,1127,1139,1140,1141,914,1142,1132,1133,1143,1144,1145,1146,911,1135,1147,914,899,900,1137,901,199,1148,1011,1149,1150,1057,1014,1151,1152,1153,899,1154,1155,1156,914,1157,1158,899,900,940,901,199,1159,1126,1127,1160,1161,1162,1163,1164,1165,899,900,940,901,199,1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1178,1179,1180,1181,1182,1183,1184,1164,1185,899,1186,1187,1185,899,1188,1189,1109,1190,1191,1111,899,1192,1193,1109,1194,1195,1196,1111,899,1197,1198,1199,1109,1200,1191,1111,899,900,940,901,199,1201,1202,1203,1204,1205,1206,1207,1208,1209,1210,914,1211,1212,1213,1214,1098,1090,1215,914,899,900,1216,901,199,1217,1218,1219,1220,1221,1222,1177,1178,1223,1224,1225,899,1180,900,1226,901,199,1227,1228,1229,1230,901,199,1231,1232,1229,1230,901,199,1233,1234,1235,1236,1237,901,199,1238,1239,1240,1161,1241,1242,901,199,1243,1244,901,199,1245,1246,1247,1248,900,1249,1250,1251,1235,1252,1253,901,199,1254,1255,901,199,1256,1257,901,199,1258,1259,1260,1261,1262,899,950,1263,1137,901,199,1264,1259,1265,1266,1267,1268,1269,899,900,1270,1137,901,199,1271,1272,1273,1267,1268,1274,1275,1276,899,900,940,901,199,1277,1278,901,199,1279,1280,1281,1282,1283,899,1284,1285,899,900,901,199,990,1286,1287,1288,1289,901,199,990,1290,1287,1288,1291,1292,1293,1294,901,199,1295,1296,1297,1298,1299,199,1300,199,1301,1302,1303,900,199,1301,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1041,1318,199,1319,1320,1321,1322,1323,1324,1325,199,1326,900,199,1301,1327,1328,1306,1307,1309,1329,1330,1041,1331,1309,1310,1311,1312,1313,1332,1315,1316,1317,1041,1318,1333,1309,1334,1335,1336,1337,1041,1338,199,1319,1339,1340,1322,1341,1324,1325,199,1326,900,199,1301,1342,1343,1306,1333,1307,1344,1308,1309,1310,1311,1312,1313,1332,1315,1316,1345,1041,1318,199,1346,1320,1347,1322,1348,1324,1325,199,1326,900,199,1301,1349,1350,1306,1333,1307,1344,1308,1309,1310,1311,1312,1313,1351,1315,1316,1352,1041,1318,199,1346,1353,199,1326,900,199,1301,1354,1355,1306,1333,1307,1344,1308,1309,1310,1311,1312,1313,1356,1315,1316,1357,1041,1318,199,1346,1358,1359,1322,1360,1324,1325,199,1326,900,199,1301,1361,1362,1363,1364,1365,1366,1367,199,1368,1322,1369,1324,1325,199,1326,1370,1371,899,900,199,1301,1372,1373,1374,1375,1376,900,199,1301,1377,1378,1374,1379,1380,900,199,1301,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392,1393,1394,1395,1396,1397,1398,1399,1400,1401,899,1322,1402,1403,1325,1322,1404,1405,1325,900,199,1301,1406,1382,1383,1384,1407,1408,1385,1388,1409,1410,1411,1412,1413,1414,1415,1416,1417,1397,1398,1399,1418,1401,899,1322,1419,1420,1325,1421,1422,1423,1424,1425,1426,1322,1427,1428,1325,1322,1429,1430,1431,1432,1325,900,199,1301,1433,1382,1383,1384,1407,1408,1322,1434,1435,1325,1436,1437,1438,1439,1440,1322,1441,1442,1443,1325,900,199,1301,1444,1382,1407,1408,1322,1445,1446,1325,900,199,1301,1447,1382,1383,1384,1448,1449,1438,1450,1451,1452,1453,1322,1454,1455,1325,900,199,1301,1456,1382,1457,1458,1407,1408,1385,1459,1460,1461,1462,1463,1464,1465,1392,1466,1467,1468,1469,1397,1398,1399,1470,1401,899,1322,1471,1472,1325,1322,1473,1474,1325,900,199,1301,1475,1382,1457,1458,1407,1408,1322,1476,1477,1325,1478,1479,1438,1480,1481,1322,1482,1483,1484,1325,1485,1486,1438,1487,1488,1322,1489,1490,1491,1325,1492,1493,1438,1494,1495,1322,1496,1497,1498,1499,1325,1500,1501,1438,1502,1322,1503,1504,1505,1506,1507,1325,900,199,1301,1508,1382,1457,1458,1492,1493,1438,1494,1495,1509,1510,1511,1512,1513,1514,1397,1398,1515,1516,1401,899,900,199,1301,1517,1382,1457,1458,1518,1519,1520,1521,1522,1523,1322,1524,1525,1325,900,199,1301,1526,1382,1457,1458,1322,1527,1528,1325,900,199,1301,1529,1382,1457,1458,1500,1501,1438,1502,1322,1530,1531,1532,1325,900,199,1301,1533,1382,1407,1408,1385,1534,1535,1536,1537,1538,1539,1397,1398,1540,1541,1401,899,900,199,1301,1542,1382,1407,1408,1509,1543,1544,1545,1546,1547,1548,1549,1550,1551,1552,1414,1397,1398,1553,1554,1401,899,900,199,1301,1555,1382,1407,1408,1509,1556,1557,1558,1559,1560,1561,1562,1563,1564,1565,1566,1397,1398,1553,1567,1401,899,900,199,1301,1568,1382,1407,1408,1509,1569,1570,1571,1572,1573,1574,1575,1576,1577,1578,1579,1397,1398,1553,1580,1401,899,900,199,1301,1581,1382,1407,1408,1509,1582,1583,1584,1572,1585,1586,1587,1588,1589,1590,1397,1398,1553,1591,1401,899,900,199,1301,1592,1382,1407,1408,1509,1593,1594,1595,1596,1597,1598,1599,1600,1601,1602,1603,1604,1605,1606,1607,1588,1608,1590,1397,1398,1553,1609,1401,899,900,199,1301,1610,1382,1611,1407,1408,1612,1613,1614,1615,1616,1397,1398,1617,1618,1401,1398,1619,1620,1401,1398,1621,1622,1401,899,900,199,1301,1623,1382,1407,1408,1509,1624,1625,1626,1627,1628,1629,1630,1631,1632,1578,1579,1397,1398,1553,1633,1401,899,900,199,1301,1634,1382,1635,1636,1385,1637,1638,1639,1640,1641,1642,1643,1644,1645,1646,1647,1648,1649,1397,1650,899,900,199,1301,1651,1382,1635,1636,1652,1653,1654,1655,1656,1657,1397,1398,1658,1659,1401,899,900,199,1301,1660,1382,1635,1636,1661,1662,199,1663,1664,1665,1666,1667,1668,1669,1670,1671,1672,1673,1090,1674,1675,1676,1677,1678,1679,1680,1681,1682,1683,1684,1685,1686,1687,1688,1689,1685,1686,1690,1691,1692,1693,1694,1695,1696,1697,1698,1699,1700,1701,1702,1698,1090,1703,914,899,199,1704,900,199,1705,1706,1707,1708,900,199,1705,1709,1710,1711,1712,900,199,1713,1714,1715,1716,900,199,1717,1718,1719,1720,1721,914,899,900,199,1722,1723,1724,1725,1726,1727,1178,1728,1729,1730,1731,1732,1090,1210,914,1733,1734,914,1735,1736,1737,1738,1737,1739,1740,1210,911,1741,1742,1210,914,1743,1744,1745,914,899,1322,1746,1747,1325,1748,900,199,1749,1750,1751,1752,1753,1754,1206,1207,1755,1210,914,1756,1757,911,1758,1759,1760,1761,1762,1763,1764,1090,1765,1766,1090,1767,1768,1090,1769,914,899,1770,1771,1772,1773,1774,899,900,199,1775,1776,1777,1778,1779,1780,900,901],"#![allow(clippy::print_stderr)]","#![allow(clippy::print_stdout)]","use std::collections::{BTreeMap, BTreeSet};","use std::env;","use std::ffi::OsStr;","use std::fs;","use std::path::{Path, PathBuf};","use std::process::{Command, ExitCode, Stdio};","use edict_syntax::{"," compile_to_core, digest_core_module, encode_core_module, parse_module, CompilerContext,"," CoreBudget,","};","fn main() -> ExitCode {"," match run() {"," Ok(()) => ExitCode::SUCCESS,"," Err(err) => {"," eprintln!(\"xtask: {err}\");"," ExitCode::FAILURE"," }"," }","}","fn run() -> Result<(), String> {"," let mut args = env::args().skip(1);"," match args.next().as_deref() {"," Some(\"contract-check\") => contract_check(&repo_root()?),"," Some(\"core-goldens\") => {"," let mode = match args.next().as_deref() {"," Some(\"--write\") => CoreGoldenMode::Write,"," Some(\"--check\") | None => CoreGoldenMode::Check,"," Some(flag) => return Err(format!(\"unknown core-goldens flag `{flag}`\")),"," };"," if let Some(extra) = args.next() {"," return Err(format!(\"unexpected core-goldens argument `{extra}`\"));"," }"," core_goldens(&repo_root()?, mode)"," Some(\"verify\") => verify(&repo_root()?),"," Some(cmd) => Err(format!(\"unknown xtask command `{cmd}`\")),"," None => Err(\"usage: cargo xtask \".into()),","fn verify(root: &Path) -> Result<(), String> {"," run_cmd(root, \"cargo\", [\"fmt\", \"--all\", \"--check\"])?;"," run_cmd("," root,"," \"cargo\","," ["," \"clippy\","," \"--workspace\","," \"--all-targets\","," \"--all-features\","," \"--\","," \"-D\","," \"warnings\","," ],"," )?;"," run_cmd(root, \"cargo\", [\"test\", \"--workspace\", \"--all-features\"])?;"," [\"test\", \"--workspace\", \"--doc\", \"--all-features\"],"," core_goldens(root, CoreGoldenMode::Check)?;"," contract_check(root)?;"," let base = diff_check_base(root)?;"," run_cmd(root, \"git\", [\"diff\", \"--check\", &format!(\"{base}...HEAD\")])?;"," Ok(())","fn run_cmd(root: &Path, program: &str, args: [&str; N]) -> Result<(), String> {"," let rendered = args.join(\" \");"," println!(\"$ {program} {rendered}\");"," let status = Command::new(program)"," .args(args)"," .current_dir(root)"," .status()"," .map_err(|err| format!(\"failed to run `{program}`: {err}\"))?;"," if status.success() {"," Ok(())"," } else {"," Err(format!(\"command failed: {program} {rendered}\"))","fn diff_check_base(root: &Path) -> Result {"," choose_diff_check_base(|candidate| git_ref_exists(root, candidate))","fn choose_diff_check_base("," mut exists: impl FnMut(&str) -> Result,",") -> Result {"," for candidate in [\"origin/main\", \"main\", \"HEAD^\"] {"," if exists(candidate)? {"," return Ok(candidate.to_owned());"," Err(\"could not find diff-check base (tried origin/main, main, HEAD^)\".into())","fn git_ref_exists(root: &Path, candidate: &str) -> Result {"," let status = Command::new(\"git\")"," .args([\"rev-parse\", \"--verify\", \"--quiet\", candidate])"," .stdout(Stdio::null())"," .stderr(Stdio::null())"," .map_err(|err| format!(\"failed to inspect git ref `{candidate}`: {err}\"))?;"," Ok(status.success())","fn contract_check(root: &Path) -> Result<(), String> {"," let docs = root.join(\"docs\");"," let topics = docs.join(\"topics\");"," let requirement_registry = read_to_string(&docs.join(\"REQUIREMENTS.md\"))?;"," let mut tests = collect_rust_test_names(&root.join(\"crates\"))?;"," tests.extend(collect_rust_test_names(&root.join(\"xtask\"))?);"," let mut topic_count = 0usize;"," for topic in dirs(&topics)? {"," topic_count += 1;"," check_topic(root, &topic, &tests, &requirement_registry)?;"," if topic_count == 0 {"," return Err(\"docs/topics contains no topic shelves\".into());"," let mut docs_to_link = vec![docs.join(\"README.md\")];"," docs_to_link.extend(markdown_files(&topics)?);"," for doc in docs_to_link {"," check_links(root, &doc)?;"," println!(\"contract-check: {topic_count} topic shelf(s) validated\");","#[derive(Debug, Clone, Copy, PartialEq, Eq)]","enum CoreGoldenMode {"," Check,"," Write,","#[derive(Debug)]","struct CoreGoldenCase {"," source: &'static str,"," bytes: &'static str,"," digest: &'static str,","const CORE_GOLDEN_CASES: &[CoreGoldenCase] = &[CoreGoldenCase {"," source: \"fixtures/lang/bounds/bounded-hello.edict\","," bytes: \"fixtures/core/canonical/bounded-hello.core.cbor\","," digest: \"fixtures/core/canonical/bounded-hello.core.sha256\",","}];","fn core_goldens(root: &Path, mode: CoreGoldenMode) -> Result<(), String> {"," for case in CORE_GOLDEN_CASES {"," check_or_write_core_golden(root, case, mode)?;"," println!("," \"core-goldens: {} case(s) {}\","," CORE_GOLDEN_CASES.len(),"," match mode {"," CoreGoldenMode::Check => \"checked\","," CoreGoldenMode::Write => \"written\","," );","fn check_or_write_core_golden("," root: &Path,"," case: &CoreGoldenCase,"," mode: CoreGoldenMode,",") -> Result<(), String> {"," let source = read_to_string(&root.join(case.source))?;"," let module = parse_module(&source).map_err(|err| format!(\"parse {}: {err}\", case.source))?;"," let core = compile_to_core(&module, &core_golden_context())"," .map_err(|err| format!(\"compile {} to Core: {err:?}\", case.source))?;"," let bytes = encode_core_module(&core)"," .map_err(|err| format!(\"encode {} as canonical Core: {err}\", case.source))?;"," let digest = digest_core_module(&core)"," .map_err(|err| format!(\"digest {} as canonical Core: {err}\", case.source))?;"," let digest_text = format!(\"{digest}\\n\");"," match mode {"," CoreGoldenMode::Check => {"," check_core_golden_file(root, case.bytes, &bytes)?;"," check_core_golden_file(root, case.digest, digest_text.as_bytes())?;"," CoreGoldenMode::Write => {"," write_core_golden_file(&root.join(case.bytes), &bytes)?;"," write_core_golden_file(&root.join(case.digest), digest_text.as_bytes())?;","fn core_golden_context() -> CompilerContext {"," CompilerContext::new()"," .with_operation_profile(\"hello.readOnly\", \"continuum.profile.read-only/v1\")"," .with_budget("," \"hello.tinyBudget\","," CoreBudget {"," max_steps: 64,"," max_allocated_bytes: 4096,"," max_output_bytes: 1024,"," },"," )","fn check_core_golden_file(root: &Path, relative: &str, expected: &[u8]) -> Result<(), String> {"," let path = root.join(relative);"," let actual = fs::read(&path).map_err(|err| format!(\"read {}: {err}\", path.display()))?;"," if actual == expected {"," Err(format!("," \"{} does not match generated Core golden; run `cargo xtask core-goldens --write`\","," path.display()"," ))","fn write_core_golden_file(path: &Path, bytes: &[u8]) -> Result<(), String> {"," if let Some(parent) = path.parent() {"," fs::create_dir_all(parent).map_err(|err| format!(\"create {}: {err}\", parent.display()))?;"," fs::write(path, bytes).map_err(|err| format!(\"write {}: {err}\", path.display()))","fn check_topic("," topic: &Path,"," tests: &BTreeSet,"," requirement_registry: &str,"," let test_plan = topic.join(\"test-plan.md\");"," let readme = topic.join(\"README.md\");"," let plan = read_to_string(&test_plan)?;"," let chapter = read_to_string(&readme)?;"," let requirements = parse_requirement_rows(&plan)?;"," let cases = parse_case_rows(&plan)?;"," if requirements.is_empty() {"," return Err(format!(\"{} has no requirement rows\", test_plan.display()));"," if cases.is_empty() {"," return Err(format!(\"{} has no case rows\", test_plan.display()));"," let requirement_ids: BTreeSet<&str> = requirements.keys().map(String::as_str).collect();"," let case_ids: BTreeSet<&str> = cases.keys().map(String::as_str).collect();"," let mut covered_requirements = BTreeSet::new();"," let mut implemented_requirements = BTreeSet::new();"," for (id, requirement) in &requirements {"," if !is_known_test_plan_status(&requirement.status) {"," return Err(format!(\"{id} has invalid status `{}`\", requirement.status));"," check_requirement_sources(root, id, &requirement.source, requirement_registry)?;"," for case in cases.values() {"," for requirement in split_cell_list(&case.requirement) {"," if !requirement_ids.contains(requirement) {"," return Err(format!("," \"{} references unknown requirement {}\","," case.id, requirement"," ));"," covered_requirements.insert(requirement.to_owned());"," if case.oracle.trim().is_empty() || case.oracle.trim() == \"-\" {"," return Err(format!(\"{} is missing a mandatory oracle\", case.id));"," match case.status.as_str() {"," \"implemented\" => {"," if case.evidence.trim().is_empty() || case.evidence.trim() == \"-\" {"," return Err(format!(\"{} is implemented without evidence\", case.id));"," }"," for evidence in split_cell_list(&case.evidence) {"," let test_name = evidence.rsplit(\"::\").next().unwrap_or(evidence);"," if !tests.contains(test_name) {"," return Err(format!("," \"{} evidence `{}` does not match a Rust test function\","," case.id, evidence"," ));"," }"," for requirement in split_cell_list(&case.requirement) {"," implemented_requirements.insert(requirement.to_owned());"," status if is_known_test_plan_status(status) => {}"," other => return Err(format!(\"{} has invalid status `{other}`\", case.id)),"," for fixture in split_cell_list(&case.fixtures) {"," if fixture != \"-\" && !root.join(fixture).is_file() {"," return Err(format!(\"{} fixture `{fixture}` does not exist\", case.id));"," if !covered_requirements.contains(id) {"," return Err(format!(\"{id} has no case\"));"," if requirement.status == \"implemented\" && !implemented_requirements.contains(id) {"," return Err(format!("," \"implemented requirement {id} has no implemented case\""," ));"," let all_topic_ids = requirement_ids"," .union(&case_ids)"," .copied()"," .collect::>();"," for id in bracket_ids(&(chapter + \"\\n\" + &plan)) {"," if (is_requirement_id(&id) || is_case_id(&id)) && !all_topic_ids.contains(id.as_str()) {"," return Err(format!(\"topic references unknown ID `{id}`\"));"," if id.starts_with(\"EDICT-\") && !registry_has_id(requirement_registry, &id) {"," return Err(format!(\"topic references unknown registry ID `{id}`\"));"," check_fixture_table(root, &plan)?;","fn is_known_test_plan_status(status: &str) -> bool {"," matches!(status, \"implemented\" | \"planned\" | \"gap\" | \"policy\")","fn parse_requirement_rows(plan: &str) -> Result, String> {"," let mut out = BTreeMap::new();"," for line in plan.lines() {"," let cells = table_cells(line);"," if cells.first().is_some_and(|cell| is_requirement_id(cell)) {"," if cells.len() < 4 {"," return Err(format!(\"malformed requirement row: {line}\"));"," let row = RequirementRow {"," id: cells[0].clone(),"," status: cells[1].clone(),"," source: cells[3].clone(),"," if out.insert(row.id.clone(), row).is_some() {"," return Err(format!(\"duplicate requirement ID {}\", cells[0]));"," Ok(out)","fn parse_case_rows(plan: &str) -> Result, String> {"," if cells.first().is_some_and(|cell| is_case_id(cell)) {"," if cells.len() < 8 {"," return Err(format!(\"malformed case row: {line}\"));"," let row = CaseRow {"," requirement: cells[3].clone(),"," oracle: cells[4].clone(),"," evidence: cells[5].clone(),"," fixtures: cells[6].clone(),"," return Err(format!(\"duplicate case ID {}\", cells[0]));","fn check_requirement_sources("," id: &str,"," source_cell: &str,"," for source in split_cell_list(source_cell) {"," if source == \"-\" {"," return Err(format!(\"{id} has no requirement source\"));"," if source.starts_with(\"EDICT-\") {"," if !registry_has_id(requirement_registry, source) {"," return Err(format!(\"{id} unknown registry source ID `{source}`\"));"," } else if !is_external_requirement_source(source) && !root.join(source).is_file() {"," return Err(format!(\"{id} source `{source}` does not resolve\"));","fn check_fixture_table(root: &Path, plan: &str) -> Result<(), String> {"," if cells"," .first()"," .is_some_and(|cell| cell.starts_with(\"fixtures/\"))"," && !root.join(&cells[0]).is_file()"," {"," return Err(format!(\"fixture table path `{}` does not exist\", cells[0]));","fn check_links(root: &Path, doc: &Path) -> Result<(), String> {"," let text = read_to_string(doc)?;"," let base = doc"," .parent()"," .ok_or_else(|| format!(\"{} has no parent\", doc.display()))?;"," let canonical_root ="," fs::canonicalize(root).map_err(|err| format!(\"canonicalize {}: {err}\", root.display()))?;"," let mut rest = text.as_str();"," while let Some(start) = rest.find(\"](\") {"," rest = &rest[start + 2..];"," let Some(end) = rest.find(')') else {"," break;"," };"," let target = &rest[..end];"," rest = &rest[end + 1..];"," if target.starts_with(\"http://\")"," || target.starts_with(\"https://\")"," || target.starts_with(\"mailto:\")"," || target.starts_with('#')"," continue;"," let path_part = target.split_once('#').map_or(target, |(path, _)| path);"," if path_part.is_empty() {"," let path = Path::new(path_part);"," if path.is_absolute() {"," \"{} has absolute local link `{target}`\","," doc.display()"," let resolved = base.join(path);"," if !resolved.exists() {"," \"{} has broken link `{target}` resolved to {}\","," doc.display(),"," resolved.display()"," let canonical_resolved = fs::canonicalize(&resolved)"," .map_err(|err| format!(\"canonicalize {}: {err}\", resolved.display()))?;"," if !canonical_resolved.starts_with(&canonical_root) {"," \"{} link `{target}` escapes repository root\",","fn collect_rust_test_names(root: &Path) -> Result, String> {"," let mut names = BTreeSet::new();"," for path in rust_files(root)? {"," let text = read_to_string(&path)?;"," let mut previous_was_test = false;"," for raw in text.lines() {"," let line = raw.trim();"," if line == \"#[test]\" {"," previous_was_test = true;"," continue;"," if previous_was_test {"," if let Some(rest) = line.strip_prefix(\"fn \") {"," if let Some((name, _)) = rest.split_once('(') {"," names.insert(name.to_owned());"," previous_was_test = false;"," Ok(names)","fn bracket_ids(text: &str) -> BTreeSet {"," let mut out = BTreeSet::new();"," let mut rest = text;"," while let Some(start) = rest.find('[') {"," rest = &rest[start + 1..];"," let Some(end) = rest.find(']') else {"," let id = &rest[..end];"," if is_requirement_id(id) || is_case_id(id) || id.starts_with(\"EDICT-\") {"," out.insert(id.to_owned());"," out","fn is_requirement_id(s: &str) -> bool {"," s.contains(\"-REQ-\")"," && s.chars()"," .all(|ch| ch.is_ascii_uppercase() || ch.is_ascii_digit() || ch == '-')","fn is_case_id(s: &str) -> bool {"," s.contains(\"-TP-\")","fn split_cell_list(cell: &str) -> impl Iterator {"," cell.split(',')"," .map(str::trim)"," .map(|s| s.trim_matches('`'))"," .filter(|s| !s.is_empty())","fn registry_has_id(requirement_registry: &str, id: &str) -> bool {"," requirement_registry.lines().any(|line| {"," table_cells(line)"," .is_some_and(|cell| cell.as_str() == id)"," })","fn is_external_requirement_source(source: &str) -> bool {"," source.starts_with(\"issue #\") || source.starts_with(\"http://\") || source.starts_with(\"https://\")","fn table_cells(line: &str) -> Vec {"," let trimmed = line.trim();"," if !trimmed.starts_with('|') || !trimmed.ends_with('|') {"," return Vec::new();"," trimmed"," .trim_matches('|')"," .split('|')"," .map(ToOwned::to_owned)"," .collect()","fn markdown_files(root: &Path) -> Result, String> {"," files_with_extension(root, \"md\")","fn rust_files(root: &Path) -> Result, String> {"," files_with_extension(root, \"rs\")","fn files_with_extension(root: &Path, extension: &str) -> Result, String> {"," let mut out = Vec::new();"," visit(root, &mut |path| {"," if path.extension() == Some(OsStr::new(extension)) {"," out.push(path.to_owned());"," })?;","fn dirs(root: &Path) -> Result, String> {"," for entry in fs::read_dir(root).map_err(|err| format!(\"read {}: {err}\", root.display()))? {"," let entry = entry.map_err(|err| format!(\"read {} entry: {err}\", root.display()))?;"," let path = entry.path();"," if path.is_dir() {"," out.push(path);"," out.sort();","fn visit(dir: &Path, f: &mut impl FnMut(&Path) -> Result<(), String>) -> Result<(), String> {"," for entry in fs::read_dir(dir).map_err(|err| format!(\"read {}: {err}\", dir.display()))? {"," let entry = entry.map_err(|err| format!(\"read {} entry: {err}\", dir.display()))?;"," visit(&path, f)?;"," } else {"," f(&path)?;","fn read_to_string(path: &Path) -> Result {"," fs::read_to_string(path).map_err(|err| format!(\"read {}: {err}\", path.display()))","fn repo_root() -> Result {"," let mut dir = env::current_dir().map_err(|err| format!(\"current dir: {err}\"))?;"," loop {"," if dir.join(\"Cargo.toml\").is_file() && dir.join(\"docs\").is_dir() {"," return Ok(dir);"," if !dir.pop() {"," return Err(\"could not find repository root\".into());","struct RequirementRow {"," id: String,"," status: String,"," source: String,","struct CaseRow {"," requirement: String,"," oracle: String,"," evidence: String,"," fixtures: String,","#[cfg(test)]","mod tests {"," use std::collections::BTreeSet;"," use std::fs;"," use std::path::{Path, PathBuf};"," use super::{check_topic, contract_check, repo_root};"," #[test]"," fn contract_graph_is_valid() {"," contract_check(&repo_root().expect(\"repo root\")).expect(\"contract graph is valid\");"," fn contract_graph_rejects_unknown_registry_source_ids() {"," let root = temp_root(\"unknown-registry-source\");"," let topic = root.join(\"docs/topics/example\");"," fs::create_dir_all(&topic).expect(\"topic directory\");"," fs::write(topic.join(\"README.md\"), \"# Example\\n\\n[EXAMPLE-REQ-001]\\n\").expect(\"chapter\");"," fs::write("," topic.join(\"test-plan.md\"),"," \"# Example Test Plan\\n\\n\\"," | ID | Status | Requirement | Source |\\n\\"," | --- | --- | --- | --- |\\n\\"," | EXAMPLE-REQ-001 | implemented | Example requirement. | EDICT-NOT-A-REAL-ID |\\n\\n\\"," | ID | Status | Category | Requirement | Oracle | Evidence | Fixtures | Notes |\\n\\"," | --- | --- | --- | --- | --- | --- | --- | --- |\\n\\"," | EXAMPLE-TP-001 | implemented | Golden path | EXAMPLE-REQ-001 | exact state | evidence_test | - | fixture-free |\\n\","," .expect(\"test plan\");"," let tests = BTreeSet::from([\"evidence_test\".to_owned()]);"," let err = check_topic(&root, &topic, &tests, \"EDICT-KNOWN-ID\")"," .expect_err(\"unknown registry Source ID must fail\");"," assert!("," err.contains(\"unknown registry source ID `EDICT-NOT-A-REAL-ID`\"),"," \"unexpected error: {err}\""," );"," fs::remove_dir_all(root).ok();"," fn contract_graph_rejects_truncated_registry_bracket_ids() {"," let root = temp_root(\"truncated-registry-bracket-id\");"," topic.join(\"README.md\"),"," \"# Example\\n\\n[EDICT-LANG-RECORD]\\n\","," .expect(\"chapter\");"," | EXAMPLE-REQ-001 | implemented | Example requirement. | docs/REQUIREMENTS.md |\\n\\n\\"," fs::create_dir_all(root.join(\"docs\")).expect(\"docs directory\");"," root.join(\"docs/REQUIREMENTS.md\"),"," \"| ID | Requirement |\\n\\"," | --- | --- |\\n\\"," | EDICT-LANG-RECORD-SHORTHAND-001 | exact longer ID |\\n\","," .expect(\"requirements\");"," let err = check_topic(&root, &topic, &tests, \"EDICT-LANG-RECORD-SHORTHAND-001\")"," .expect_err(\"truncated registry ID must fail\");"," err.contains(\"unknown registry ID `EDICT-LANG-RECORD`\"),"," fn contract_graph_requires_implemented_evidence_for_implemented_requirements() {"," let root = temp_root(\"implemented-requirement-without-evidence\");"," fs::write(root.join(\"docs/REQUIREMENTS.md\"), \"# Requirements\\n\").expect(\"requirements\");"," | EXAMPLE-TP-001 | planned | Golden path | EXAMPLE-REQ-001 | exact state | - | - | planned only |\\n\","," let tests = BTreeSet::new();"," .expect_err(\"implemented requirement without implemented case must fail\");"," err.contains(\"implemented requirement EXAMPLE-REQ-001 has no implemented case\"),"," fn contract_graph_accepts_policy_rows_without_rust_evidence() {"," let root = temp_root(\"policy-rows-without-rust-evidence\");"," | EXAMPLE-REQ-001 | policy | Example policy. | docs/REQUIREMENTS.md |\\n\\n\\"," | EXAMPLE-TP-001 | policy | Review policy | EXAMPLE-REQ-001 | human review records the policy decision | - | - | no executable software behavior |\\n\","," check_topic(&root, &topic, &tests, \"\").expect(\"policy rows require no Rust evidence\");"," fn contract_graph_rejects_unknown_requirement_status() {"," let root = temp_root(\"unknown-requirement-status\");"," | EXAMPLE-REQ-001 | maybe | Example requirement. | docs/REQUIREMENTS.md |\\n\\n\\"," | EXAMPLE-TP-001 | planned | Planned path | EXAMPLE-REQ-001 | exact state | - | - | planned only |\\n\","," let err = check_topic(&root, &topic, &tests, \"\")"," .expect_err(\"unknown requirement status must reject\");"," err.contains(\"EXAMPLE-REQ-001 has invalid status `maybe`\"),"," fn link_check_rejects_local_links_outside_repo() {"," let root = temp_root(\"repo-escaping-link\");"," let outside = temp_root(\"repo-escaping-link-outside\").join(\"outside.md\");"," fs::write(&outside, \"# Outside\\n\").expect(\"outside file\");"," let doc = root.join(\"docs/topics/example/README.md\");"," fs::create_dir_all(doc.parent().expect(\"doc parent\")).expect(\"doc directory\");"," fs::write(&doc, format!(\"# Example\\n\\n[bad]({})\\n\", outside.display())).expect(\"chapter\");"," let err = super::check_links(&root, &doc).expect_err(\"absolute local links must reject\");"," err.contains(\"absolute local link\"),"," if let Some(parent) = outside.parent() {"," fs::remove_dir_all(parent).ok();"," fn diff_check_base_selection_falls_back_without_origin_main() {"," let refs = BTreeSet::from([\"HEAD^\"]);"," let base = super::choose_diff_check_base(|candidate| Ok(refs.contains(candidate)))"," .expect(\"fallback diff base\");"," assert_eq!(base, \"HEAD^\");"," fn diff_check_base_selection_prefers_origin_main() {"," let refs = BTreeSet::from([\"origin/main\", \"main\", \"HEAD^\"]);"," .expect(\"preferred diff base\");"," assert_eq!(base, \"origin/main\");"," fn release_workflow_publishes_only_main_reachable_tags() {"," let root = repo_root().expect(\"repo root\");"," let workflow ="," fs::read_to_string(root.join(\".github/workflows/release.yml\")).expect(\"workflow\");"," for needle in ["," \"tags:\","," \"\\\"v*\\\"\","," \"workflow_dispatch:\","," \"contents: write\","," \"git merge-base --is-ancestor\","," \"origin/main\","," \"docs/releases/${TAG}.md\","," \"release create\","," \"--verify-tag\","," \"--prerelease\","," \"prerelease=true\","," ] {"," assert!("," workflow.contains(needle),"," \"release workflow missing expected guard/action: {needle}\""," );"," !workflow.contains(\"cargo publish\"),"," \"release workflow must not publish crates\""," !workflow.contains(\"git fetch --force\"),"," \"release workflow must not force-fetch refs\""," fn release_workflow_supports_dispatch_and_milestone_closure() {"," let policy = fs::read_to_string(root.join(\"docs/topics/release-process/policy.toml\"))"," .expect(\"release policy\");"," \"RELEASE_TAG:\","," \"inputs.tag\","," \"issues: write\","," \"milestones?state=all\","," \"OPEN_ISSUES\","," \"gh release view\","," \"Close release milestone\","," \"--method PATCH\","," \"-f state=closed\","," \"release workflow missing dispatch/milestone guard: {needle}\""," policy.contains(\"publication_before_milestone_closure = true\"),"," \"release policy must require publication before milestone closure\""," let publish_step = workflow"," .find(\"name: Publish GitHub release\")"," .expect(\"release workflow must publish the GitHub Release\");"," let close_step = workflow"," .find(\"name: Close release milestone\")"," .expect(\"release workflow must close the milestone\");"," publish_step < close_step,"," \"release workflow must close the milestone only after publishing the release\""," workflow.contains(\"MILESTONE_NUMBER=\\\"${{ steps.release.outputs.milestone_number }}\\\"\")"," && workflow"," .contains(\"MILESTONE_STATE=\\\"${{ steps.release.outputs.milestone_state }}\\\"\",),"," \"milestone closure must be driven by release verification outputs\""," fn release_workflow_paginates_milestone_lookup() {"," policy.contains(\"milestone_lookup = \\\"paginated_all_states\\\"\"),"," \"release automation policy must require paginated all-state milestone lookup\""," let verification_step = workflow"," .split(\"name: Verify tag target, release notes, and milestone\")"," .nth(1)"," .and_then(|tail| tail.split(\"name: Publish GitHub release\").next())"," .expect(\"release verification step\");"," verification_step"," .contains(\"gh api --paginate \\\"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\\\"\"),"," \"release workflow must paginate all-state milestone lookup\""," fn release_milestone_lookup_consumes_complete_paginated_stream() {"," policy.contains(\"milestone_selection = \\\"complete_stream_first_match\\\"\"),"," \"release automation policy must require full-stream milestone selection\""," fn release_workflow_checks_out_release_tag_for_dispatch() {"," let checkout_step = workflow"," .split(\"actions/checkout@\")"," .and_then(|tail| tail.split(\"- name: Verify tag target\").next())"," .expect(\"release workflow checkout block\");"," let release_ref ="," \"${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}\";"," checkout_step.contains(&format!(\"ref: {release_ref}\")),"," \"release workflow must read release notes from the tag being published\""," fn auto_release_tag_workflow_is_guarded() {"," let workflow = fs::read_to_string(root.join(\".github/workflows/auto-release-tag.yml\"))"," .expect(\"auto release workflow\");"," \"workflow_run:\","," \"workflows: [\\\"CI\\\"]\","," \"branches: [main]\","," \"github.event.workflow_run.conclusion == 'success'\","," \"github.event.workflow_run.event == 'push'\","," \"/commits/${SHA}/pulls\","," \"^release/v[0-9]+\","," \"git tag -a\","," \"refusing to move\","," \"gh workflow run release.yml\","," \"actions: write\","," \"auto release workflow missing guard/action: {needle}\""," !workflow.contains(\"--force\"),"," \"auto release workflow must not force any git operation\""," policy.contains(\"source_event = \\\"push\\\"\"),"," \"release automation policy must restrict auto-tagging to push CI runs\""," fn auto_release_tag_workflow_scopes_job_permissions() {"," policy.contains(\"job_permissions = \\\"least_privilege\\\"\"),"," \"release automation policy must require least-privilege job permissions\""," let top_level_permissions = workflow"," .split(\"permissions:\")"," .and_then(|tail| tail.split(\"\\njobs:\").next())"," .expect(\"top-level permissions block\");"," top_level_permissions.contains(\"contents: read\")"," && !top_level_permissions.contains(\"write\"),"," \"top-level auto-release permissions must be read-only\""," let identify_job = workflow"," .split(\"identify-release-pr:\")"," .and_then(|tail| tail.split(\"create-release-tag:\").next())"," .expect(\"identify-release-pr job block\");"," identify_job.contains(\"permissions:\\n contents: read\\n pull-requests: read\")"," && !identify_job.contains(\"write\"),"," \"identify-release-pr must only read contents and pull requests\""," let tag_job = workflow"," .split(\"create-release-tag:\")"," .and_then(|tail| tail.split(\"dispatch-release-publication:\").next())"," .expect(\"create-release-tag job block\");"," tag_job.contains(\"permissions:\\n contents: write\\n issues: read\")"," && !tag_job.contains(\"actions: write\")"," && !tag_job.contains(\"pull-requests: write\"),"," \"create-release-tag must only write contents and read issues\""," let dispatch_job = workflow"," .split(\"dispatch-release-publication:\")"," .expect(\"dispatch-release-publication job block\");"," dispatch_job.contains(\"permissions:\\n actions: write\")"," && !dispatch_job.contains(\"contents: write\")"," && !dispatch_job.contains(\"issues: write\")"," && !dispatch_job.contains(\"pull-requests: write\"),"," \"dispatch-release-publication must only write actions\""," fn auto_release_tag_uses_ephemeral_push_credentials() {"," for required in ["," \"persist-credentials: false\","," \"GIT_AUTH_CONFIG=\\\"http.https://github.com/.extraheader=${GIT_AUTH_HEADER}\\\"\","," \"git -c \\\"${GIT_AUTH_CONFIG}\\\" ls-remote\","," \"git -c \\\"${GIT_AUTH_CONFIG}\\\" fetch\","," \"git -c \\\"${GIT_AUTH_CONFIG}\\\" push origin\","," tag_job.contains(required),"," \"create-release-tag job missing ephemeral credential guard: {required}\""," fn auto_release_tag_checks_milestone_before_tag_push() {"," let milestone_check = workflow"," .find(\"OPEN_ISSUES\")"," .expect(\"auto release workflow must check milestone open issue count\");"," let tag_creation = workflow"," .find(\"git tag -a\")"," .expect(\"auto release workflow must create an annotated tag\");"," milestone_check < tag_creation,"," \"auto release workflow must check milestone readiness before creating an immutable tag\""," fn auto_release_tag_dispatches_release_from_tag_ref() {"," workflow.contains(r#\"gh workflow run release.yml --ref \"${TAG}\" -f tag=\"${TAG}\"\"#),"," \"auto release workflow must dispatch release.yml from the created tag ref\""," fn auto_release_tag_dispatches_with_explicit_repo() {"," dispatch_job.contains(\"GH_REPO: ${{ github.repository }}\")"," || dispatch_job.contains(\"--repo \\\"${GITHUB_REPOSITORY}\\\"\"),"," \"release dispatch must name the repository explicitly\""," fn release_tag_recovery_policy_is_structured() {"," \"[release_tags]\","," \"mutation = \\\"forbidden\\\"\","," \"recovery = \\\"publish_existing_valid_tag\\\"\","," \"requires_main_reachable_target = true\","," \"normal_creation = \\\"auto_after_release_pr_main_ci\\\"\","," \"manual_creation = \\\"operator_fallback\\\"\","," policy.contains(needle),"," \"release policy missing structured field: {needle}\""," fn release_runbook_policy_is_structured() {"," \"[release_runbook]\","," \"prepare_branch\","," \"merge_gate\","," \"auto_tag_publish\","," \"watch_workflow\","," \"capture_evidence\","," \"manual_fallback_target = \\\"verified_main_merge_commit\\\"\","," \"post_release_milestone_lookup = \\\"all_states_paginated\\\"\","," \"cargo xtask verify\","," \"gh pr checks\","," policy.contains(required),"," \"release runbook policy missing structured field: {required}\""," fn release_automation_policy_is_structured() {"," \"[release_automation]\","," \"trigger = \\\"successful_main_ci_after_release_prep_merge\\\"\","," \"source_branch_pattern = \\\"release/vX.Y.Z-alpha.N-prep\\\"\","," \"tag_derivation = \\\"strip_release_prefix_and_prep_suffix\\\"\","," \"publication_trigger = \\\"workflow_dispatch\\\"\","," \"close_milestone = \\\"after_github_release_when_zero_open_issues\\\"\","," \"idempotency = \\\"existing_same_target_tag_ok\\\"\","," \"existing_different_target_tag = \\\"fail_without_mutation\\\"\","," \"merged_release_pr\","," \"tag_absent_or_same_target\","," \"zero_open_milestone_issues\","," \"release automation policy missing structured field: {required}\""," fn release_policy_tracks_v0_3_boundary() {"," \"[release_notes.v0_3_0_alpha_1]\","," \"tag = \\\"v0.3.0-alpha.1\\\"\","," \"target_date = \\\"2026-07-15\\\"\","," \"status = \\\"published\\\"\","," \"compiler_spine\","," \"surface_validation_split\","," \"canonical_core_encoder\","," \"reviewed_core_golden_fixture\","," \"exact_core_digest_fixture\","," \"no_target_lowering\","," \"no_bundle_admission\","," \"v0.3 release policy missing structured field: {required}\""," fn release_policy_tracks_v0_4_boundary() {"," \"[release_notes.v0_4_0_alpha_1]\","," \"tag = \\\"v0.4.0-alpha.1\\\"\","," \"target_date = \\\"2026-07-29\\\"\","," \"target_profile_conformance\","," \"lowerability_direct_adapter\","," \"contract_bundle_manifest_validation\","," \"no_target_lowerer_execution\","," \"no_admission_policy\","," \"no_crates_io_publish\","," \"v0.4 release policy missing structured field: {required}\""," fn release_policy_tracks_v0_5_boundary() {"," \"[release_notes.v0_5_0_alpha_1]\","," \"tag = \\\"v0.5.0-alpha.1\\\"\","," \"target_date = \\\"2026-08-12\\\"\","," \"status = \\\"publish_ready\\\"\","," \"edict_owned_continuum_participation_boundary\","," \"gate_c_admission_request_validation\","," \"gate_c_admission_receipt_validation\","," \"admission_request_digest_binding\","," \"policy_epoch_receipt_binding\","," \"invocation_capability_evidence_validation\","," \"release_automation_after_main_ci\","," \"no_participant_policy_evaluation\","," \"no_participant_identity_delegation_or_revocation\","," \"no_admission_ledger_persistence\","," \"no_signature_verification\","," \"no_bundle_digest_recomputation\","," \"v0.5 release policy missing structured field: {required}\""," fn alpha_changelog_dates_match_release_policy() {"," let changelog = fs::read_to_string(root.join(\"CHANGELOG.md\")).expect(\"changelog\");"," for (tag, target) in ["," (\"v0.2.0-alpha.1\", \"2026-07-01\"),"," (\"v0.3.0-alpha.1\", \"2026-07-15\"),"," (\"v0.4.0-alpha.1\", \"2026-07-29\"),"," (\"v0.5.0-alpha.1\", \"2026-08-12\"),"," policy.contains(&format!(\"tag = \\\"{tag}\\\"\")),"," \"release policy missing tag {tag}\""," policy.contains(&format!(\"target_date = \\\"{target}\\\"\")),"," \"release policy missing target date {target}\""," changelog.contains(&format!(\"## [{tag}] - {target}\")),"," \"{tag} changelog date must match release policy target date {target}\""," fn release_policy_tracks_v0_2_boundary() {"," \"[release_notes.v0_2_0_alpha_1]\","," \"tag = \\\"v0.2.0-alpha.1\\\"\","," \"target_date = \\\"2026-07-01\\\"\","," \"core_semantic_model\","," \"normative_core_schema\","," \"no_source_to_core_lowering\","," \"no_canonical_encoder\","," \"no_golden_core_bytes\","," \"no_exact_core_digests\","," \"v0.2 release policy missing structured field: {required}\""," fn core_cddl_declares_v1_semantic_model() {"," let cddl ="," fs::read_to_string(root.join(\"docs/abi/edict-core.cddl\")).expect(\"Core schema exists\");"," \"core-module =\","," \"apiVersion: \\\"edict.core/v1\\\"\","," \"core-type =\","," \"core-intent =\","," \"core-block =\","," \"core-node =\","," \"core-expr =\","," \"core-predicate =\","," \"core-fn-body =\","," \"input-constraint =\","," \"local-ref =\","," \"alphaName:\","," \"requiredOperationProfile:\","," assert!(cddl.contains(needle), \"Core CDDL missing {needle}\");"," fn core_cddl_has_no_digest_freeze_fields() {"," for forbidden in ["," \"coreDigest\","," \"canonicalCoreDigest\","," \"canonicalBytes\","," \"goldenBytes\","," \"exactDigest\","," !cddl.contains(forbidden),"," \"v0.2 Core schema must not freeze byte/hash field `{forbidden}`\""," fn core_schema_shape_fixtures_match_cddl() {"," let fixture_root = root.join(\"fixtures/core/schema\");"," let mut checked = 0usize;"," for expectation in [FixtureExpectation::Accept, FixtureExpectation::Reject] {"," let dir = fixture_root.join(expectation.dir_name());"," for entry in fs::read_dir(&dir).unwrap_or_else(|err| {"," panic!("," \"read Core schema fixture directory {}: {err}\","," dir.display()"," )"," }) {"," let path = entry.expect(\"fixture entry\").path();"," if path.extension().and_then(|ext| ext.to_str()) != Some(\"fields\") {"," continue;"," let fixture = parse_core_schema_fixture(&path);"," assert_eq!("," fixture.expectation,"," expectation,"," \"{} expectation disagrees with directory name\","," path.display()"," );"," let shape = core_shape_fields(&cddl, &fixture.shape);"," let missing = shape"," .required"," .difference(&fixture.fields)"," .cloned()"," .collect::>();"," let unknown = fixture"," .fields"," .difference(&shape.allowed)"," let valid = missing.is_empty() && unknown.is_empty();"," match expectation {"," FixtureExpectation::Accept => assert!("," valid,"," \"{} should be accepted; missing {:?}, unknown {:?}\","," path.display(),"," missing,"," unknown"," ),"," FixtureExpectation::Reject => assert!("," !valid,"," \"{} should be rejected by schema shape validation\","," path.display()"," checked += 1;"," assert!(checked >= 5, \"expected at least 5 Core schema fixtures\");"," #[derive(Debug)]"," struct CoreShapeFields {"," allowed: BTreeSet,"," required: BTreeSet,"," struct CoreSchemaFixture {"," expectation: FixtureExpectation,"," fields: BTreeSet,"," shape: String,"," #[derive(Copy, Clone, Debug, Eq, PartialEq)]"," enum FixtureExpectation {"," Accept,"," Reject,"," impl FixtureExpectation {"," fn dir_name(self) -> &'static str {"," match self {"," Self::Accept => \"accepted\","," Self::Reject => \"rejected\","," fn core_shape_fields(cddl: &str, shape: &str) -> CoreShapeFields {"," let start = format!(\"{shape} = {{\");"," let mut in_shape = false;"," let mut fields = CoreShapeFields {"," allowed: BTreeSet::new(),"," required: BTreeSet::new(),"," for raw in cddl.lines() {"," let line = raw.split_once(';').map_or(raw, |(before, _)| before).trim();"," if !in_shape {"," if line == start {"," in_shape = true;"," if line.starts_with('}') {"," break;"," let Some((field, _)) = line"," .strip_suffix(',')"," .unwrap_or(line)"," .strip_prefix(\"? \")"," .split_once(':')"," else {"," let field = field.trim();"," if field.is_empty() || field.contains(char::is_whitespace) {"," fields.allowed.insert(field.to_owned());"," if !line.starts_with(\"? \") {"," fields.required.insert(field.to_owned());"," !fields.allowed.is_empty(),"," \"no fields parsed for Core shape {shape}\""," fields"," fn parse_core_schema_fixture(path: &Path) -> CoreSchemaFixture {"," let text = fs::read_to_string(path)"," .unwrap_or_else(|err| panic!(\"read Core schema fixture {}: {err}\", path.display()));"," let mut expectation = None;"," let mut shape = None;"," let mut fields = BTreeSet::new();"," if line.is_empty() || line.starts_with('#') {"," let Some((key, value)) = line.split_once(' ') else {"," panic!(\"{} has malformed line `{line}`\", path.display());"," match key {"," \"expect\" => {"," expectation = Some(match value {"," \"accept\" => FixtureExpectation::Accept,"," \"reject\" => FixtureExpectation::Reject,"," other => panic!(\"{} has invalid expectation `{other}`\", path.display()),"," });"," \"field\" => {"," fields.insert(value.to_owned());"," \"shape\" => {"," shape = Some(value.to_owned());"," other => panic!(\"{} has unknown directive `{other}`\", path.display()),"," CoreSchemaFixture {"," expectation: expectation"," .unwrap_or_else(|| panic!(\"{} missing expectation\", path.display())),"," fields,"," shape: shape.unwrap_or_else(|| panic!(\"{} missing shape\", path.display())),"," fn temp_root(name: &str) -> PathBuf {"," let mut dir = std::env::temp_dir();"," dir.push(format!(\"edict-xtask-{name}-{}\", std::process::id()));"," fs::remove_dir_all(&dir).ok();"," fs::create_dir_all(&dir).expect(\"temp root\");"," dir",".github/workflows/release.yml",[1783],{"_779":780,"_781":1784,"_417":1785,"_784":59},144,[1786,199,1787,1788,1789,1790,1791,1792,1793,1794,1795,1796,199,1797,1798,1799,199,1800,1801,1802,199,1803,1804,1805,1806,1807,1808,1809,1810,1811,1812,1813,199,1814,1815,1816,1817,1818,1819,1820,1821,199,1822,199,1823,1824,1825,1826,199,1827,1828,1829,1830,199,1831,1832,1833,1829,1830,199,1834,1835,1829,1830,199,1836,1837,1838,199,1839,1840,1829,1830,199,1841,1842,1843,199,1844,1845,1829,1830,199,1846,1847,1848,1849,1850,1851,1852,1853,1854,1855,1856,1857,199,1858,1816,1817,1819,1820,1821,199,1859,1860,1861,199,1862,1863,1864,1830,199,1865,1866,1867,1868,1869,1870,199,1871,1872,1830,199,1873,199,1874,1816,1817,1819,1820,1821,199,1875,1876,199,1877,1878,1864,1830,199,1879,1880,1881,1882],"name: Release","on:"," push:"," tags:"," - \"v*\""," workflow_dispatch:"," inputs:"," tag:"," description: \"Existing v* release tag to publish\""," required: true"," type: string","permissions:"," contents: write"," issues: write","concurrency:"," group: release-${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}"," cancel-in-progress: false","jobs:"," github-release:"," name: publish GitHub release"," runs-on: ubuntu-latest"," if: startsWith(github.ref, 'refs/tags/v') || github.event_name == 'workflow_dispatch'"," steps:"," - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0"," with:"," fetch-depth: 0"," persist-credentials: false"," ref: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}"," - name: Verify tag target, release notes, and milestone"," id: release"," env:"," GH_TOKEN: ${{ github.token }}"," RELEASE_TAG: ${{ github.event_name == 'workflow_dispatch' && inputs.tag || github.ref_name }}"," shell: bash"," run: |"," set -euo pipefail"," git fetch origin main:refs/remotes/origin/main --tags"," TAG=\"${RELEASE_TAG}\""," VERSION=\"${TAG#v}\""," NOTES=\"docs/releases/${TAG}.md\""," TAG_COMMIT=\"$(git rev-parse \"${TAG}^{commit}\")\""," if [[ ! \"${TAG}\" =~ ^v[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then"," echo \"::error::Release tag must look like a SemVer v* tag: ${TAG}\""," exit 1"," fi"," if ! git merge-base --is-ancestor \"${TAG_COMMIT}\" origin/main; then"," echo \"::error::Release tags must target commits reachable from origin/main.\""," echo \"::error::Tag ${TAG} targets ${TAG_COMMIT}, which is not on origin/main.\""," if [[ ! -f \"${NOTES}\" ]]; then"," echo \"::error::Missing release notes file: ${NOTES}\""," MILESTONE_JSON=\"$(gh api --paginate \"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\" \\"," --jq \".[] | select(.title == \\\"${TAG}\\\")\" |"," jq -s '.[0] // empty')\""," if [[ -z \"${MILESTONE_JSON}\" ]]; then"," echo \"::error::Missing release milestone matching ${TAG}.\""," MILESTONE_NUMBER=\"$(jq -r '.number' <<<\"${MILESTONE_JSON}\")\""," MILESTONE_STATE=\"$(jq -r '.state' <<<\"${MILESTONE_JSON}\")\""," OPEN_ISSUES=\"$(jq -r '.open_issues' <<<\"${MILESTONE_JSON}\")\""," if [[ \"${OPEN_ISSUES}\" != \"0\" ]]; then"," echo \"::error::Milestone ${TAG} still has ${OPEN_ISSUES} open issue(s).\""," {"," echo \"tag=${TAG}\""," echo \"version=${VERSION}\""," echo \"notes=${NOTES}\""," echo \"milestone_number=${MILESTONE_NUMBER}\""," echo \"milestone_state=${MILESTONE_STATE}\""," if [[ \"${VERSION}\" == *-* ]]; then"," echo \"prerelease=true\""," else"," echo \"prerelease=false\""," fi"," } >>\"${GITHUB_OUTPUT}\""," - name: Publish GitHub release"," TAG=\"${{ steps.release.outputs.tag }}\""," NOTES=\"${{ steps.release.outputs.notes }}\""," PRERELEASE=\"${{ steps.release.outputs.prerelease }}\""," if gh release view \"${TAG}\" >/dev/null 2>&1; then"," echo \"::notice::GitHub release ${TAG} already exists; leaving it unchanged.\""," exit 0"," args=("," release create \"${TAG}\""," --verify-tag"," --title \"${TAG}\""," --notes-file \"${NOTES}\""," )"," if [[ \"${PRERELEASE}\" == \"true\" ]]; then"," args+=(--prerelease)"," gh \"${args[@]}\""," - name: Close release milestone"," MILESTONE_NUMBER=\"${{ steps.release.outputs.milestone_number }}\""," MILESTONE_STATE=\"${{ steps.release.outputs.milestone_state }}\""," if [[ \"${MILESTONE_STATE}\" == \"closed\" ]]; then"," echo \"::notice::Milestone is already closed.\""," gh api \\"," --method PATCH \\"," \"repos/${GITHUB_REPOSITORY}/milestones/${MILESTONE_NUMBER}\" \\"," -f state=closed >/dev/null",".github/workflows/auto-release-tag.yml",[1885],{"_779":780,"_781":1886,"_417":1887,"_784":59},173,[1888,199,1787,1889,1890,1891,1892,199,1797,1893,199,1800,1894,1802,199,1803,1895,1896,1806,1897,1898,1899,1900,1901,1902,1903,1904,1905,1808,1809,1810,1906,1811,199,1907,1908,1816,1817,1909,1819,1820,1821,199,1910,1911,1912,199,1913,1914,1915,1916,1917,1918,199,1919,1920,1921,1864,1830,199,1922,1923,1829,1830,199,1924,1925,1926,199,1927,1928,1829,1830,199,1929,1825,199,1834,1835,1829,1830,199,1846,1930,1847,1931,1932,1857,199,1933,1934,1935,1806,1936,1898,1937,1938,1808,1809,1810,1939,1811,1812,199,1940,1941,1816,1817,1942,1943,1819,1820,1821,199,1944,1945,1946,1947,199,1836,1837,1838,199,1839,1840,1829,1830,199,1843,199,1844,1845,1829,1830,199,1948,1949,1950,199,1951,1952,1953,1856,199,1954,1955,1864,1830,199,1956,1957,1958,199,1959,1960,1961,1962,1963,1806,1936,1898,1964,1808,1965,1816,1817,1966,1942,1819,1820,1821,199,1967],"name: Auto Release Tag"," workflow_run:"," workflows: [\"CI\"]"," types: [completed]"," branches: [main]"," contents: read"," group: auto-release-tag-${{ github.event.workflow_run.head_sha }}"," identify-release-pr:"," name: identify merged release PR"," if: github.event.workflow_run.conclusion == 'success' && github.event.workflow_run.event == 'push'"," permissions:"," contents: read"," pull-requests: read"," outputs:"," release: ${{ steps.release_pr.outputs.release }}"," tag: ${{ steps.release_pr.outputs.tag }}"," pr: ${{ steps.release_pr.outputs.pr }}"," sha: ${{ steps.release_pr.outputs.sha }}"," ref: ${{ github.event.workflow_run.head_sha }}"," - name: Identify merged release PR"," id: release_pr"," SHA: ${{ github.event.workflow_run.head_sha }}"," PRS_JSON=\"$(gh api \\"," -H \"Accept: application/vnd.github+json\" \\"," \"/repos/${GITHUB_REPOSITORY}/commits/${SHA}/pulls\")\""," MATCHES=\"$(jq '[.[] | select("," .merged_at != null and"," .base.ref == \"main\" and"," (.head.ref | test(\"^release/v[0-9]+\\\\.[0-9]+\\\\.[0-9]+-alpha\\\\.[0-9]+-prep$\"))"," )]' <<<\"${PRS_JSON}\")\""," COUNT=\"$(jq 'length' <<<\"${MATCHES}\")\""," if [[ \"${COUNT}\" == \"0\" ]]; then"," echo \"::notice::Successful main CI did not come from a release-prep PR.\""," echo \"release=false\" >>\"${GITHUB_OUTPUT}\""," if [[ \"${COUNT}\" != \"1\" ]]; then"," echo \"::error::Expected exactly one release-prep PR for ${SHA}; found ${COUNT}.\""," HEAD_REF=\"$(jq -r '.[0].head.ref' <<<\"${MATCHES}\")\""," PR_NUMBER=\"$(jq -r '.[0].number' <<<\"${MATCHES}\")\""," RELEASE_BRANCH_REGEX='^release/(v[0-9]+\\.[0-9]+\\.[0-9]+-alpha\\.[0-9]+)-prep$'"," if [[ ! \"${HEAD_REF}\" =~ ${RELEASE_BRANCH_REGEX} ]]; then"," echo \"::error::Release branch did not match expected pattern: ${HEAD_REF}\""," TAG=\"${BASH_REMATCH[1]}\""," echo \"release=true\""," echo \"pr=${PR_NUMBER}\""," echo \"sha=${SHA}\""," create-release-tag:"," name: create immutable release tag"," needs: identify-release-pr"," if: needs.identify-release-pr.outputs.release == 'true'"," contents: write"," issues: read"," ref: ${{ needs.identify-release-pr.outputs.sha }}"," - name: Create immutable release tag"," id: tag"," TAG: ${{ needs.identify-release-pr.outputs.tag }}"," SHA: ${{ needs.identify-release-pr.outputs.sha }}"," git config user.name \"github-actions[bot]\""," git config user.email \"41898282+github-actions[bot]@users.noreply.github.com\""," GIT_AUTH_HEADER=\"AUTHORIZATION: bearer ${GH_TOKEN}\""," GIT_AUTH_CONFIG=\"http.https://github.com/.extraheader=${GIT_AUTH_HEADER}\""," if git -c \"${GIT_AUTH_CONFIG}\" ls-remote --exit-code --tags origin \"refs/tags/${TAG}\" >/dev/null 2>&1; then"," git -c \"${GIT_AUTH_CONFIG}\" fetch origin \"refs/tags/${TAG}:refs/tags/${TAG}\""," TAG_COMMIT=\"$(git rev-parse \"${TAG}^{commit}\")\""," if [[ \"${TAG_COMMIT}\" != \"${SHA}\" ]]; then"," echo \"::error::Tag ${TAG} already targets ${TAG_COMMIT}; refusing to move it to ${SHA}.\""," exit 1"," echo \"::notice::Tag ${TAG} already targets ${SHA}.\""," echo \"created=false\" >>\"${GITHUB_OUTPUT}\""," git tag -a \"${TAG}\" \"${SHA}\" -m \"${TAG}\""," git -c \"${GIT_AUTH_CONFIG}\" push origin \"refs/tags/${TAG}\""," echo \"created=true\" >>\"${GITHUB_OUTPUT}\""," dispatch-release-publication:"," name: dispatch release publication"," needs:"," - identify-release-pr"," - create-release-tag"," actions: write"," - name: Dispatch release publication"," GH_REPO: ${{ github.repository }}"," gh workflow run release.yml --ref \"${TAG}\" -f tag=\"${TAG}\"",[1969,1970,1971,1972,1973,1974,1975,1976,1977,1978,1979],{"_754":46,"_46":1995},{"_754":1981,"_161":1883,"_779":1993,"_781":1994},{"_754":46,"_46":1992},{"_754":1981,"_161":1883,"_779":1991,"_781":1886},{"_754":46,"_46":1990},{"_754":1981,"_161":1781,"_779":1988,"_781":1989},{"_754":46,"_46":1987},{"_754":1981,"_161":876,"_779":1985,"_781":1986},{"_754":46,"_46":1984},{"_754":1981,"_161":773,"_779":1982,"_781":1983},{"_754":46,"_46":1980},"\n\n**Testing**\n\n* ✅ `cargo test -p xtask release_`\n* ⚠️ `git diff --check origin/main...HEAD` — warning due to this local checkout not having `origin/main` available.\n* ⚠️ `actionlint` — warning because `actionlint` is not installed in this environment.\n* ⚠️ `codex-think --remember --json` — warning because `codex-think` is not installed in this environment.","repo_file_citation",134,139,"\n* Confirmed the runbook milestone verification command uses the same paginated all-state query contract operators need after milestone closure. ",936,1133,"\n* Confirmed xtask coverage exists for release tag checkout, paginated milestone lookup, push-event guarding, least-privilege job permissions, ephemeral credentials, milestone-before-tag ordering, tag-ref dispatch, and explicit repository dispatch context. ",28,68,"\n* Confirmed the release workflow checks out the selected tag before reading release artifacts and uses the paginated all-state milestone lookup without `head`. ",154,"\n* Confirmed the dispatch job provides explicit repository context via `GH_REPO` and dispatches `release.yml` from the created tag ref. ",99,151,"### Summary\n\n* Reviewed the latest PR follow-up state and found the requested release-automation hardening already present on the current branch, so I made no additional code changes, did not create a commit, and did not open a new PR.\n* Confirmed the auto-release tag job disables persisted checkout credentials and uses per-command Git authentication for `ls-remote`, `fetch`, and `push`. ",{"_92":325,"_42":84,"_96":325,"_1998":1999,"_2000":2001,"_2002":2003,"_132":-5,"_119":2004},[83],"input_items",[2023,2024,2025,2026,2027,2028,2029,2030,2031,2032,2033,2034,2035,2036,2037,2038,2039,2040,2041,2042,2043,2044,2045,2046,2047,2048],"external_post_config",{"_2005":2006,"_263":196,"_2007":305,"_274":-5,"_2008":257,"_2009":-5,"_2010":-5,"_2011":2012,"_2013":2014,"_2015":-5,"_2016":-5,"_2017":2018,"_2019":15,"_2020":59,"_2021":54,"_2022":15},"user_model_slug","slug",1782415590.882553,"installation_id",89912914,"pr_number","repo_id","gitlab_service_account_project_id","review_trigger","comment_id",4803428191,"comment_type","issue","pr_write_guard_token","pending_pr_reaction_id","pending_comment_reaction_id",374835864,"comment_if_no_findings","comment_on_error","share_url","is_parallel_review",{"_92":423,"_96":325,"_417":2088},{"_312":313,"_314":315,"_2085":319,"_2086":129,"_321":-5,"_92":2087},{"_92":2049,"_314":2084,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2083,"_161":1883,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2082,"_161":1781,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2080,"_161":876,"_2051":2054,"_2052":2081},{"_92":2049,"_314":2078,"_161":876,"_2051":2054,"_2052":2079},{"_92":2049,"_314":2077,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2076,"_161":1883,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2075,"_161":1883,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2074,"_161":773,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2073,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2072,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2070,"_161":1883,"_2051":2054,"_2052":2071},{"_92":2049,"_314":2068,"_161":876,"_2051":2054,"_2052":2069},{"_92":2049,"_314":2066,"_161":876,"_2051":2054,"_2052":2067},{"_92":2049,"_314":2065,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2064,"_161":1883,"_2051":2054,"_2052":1886},{"_92":2049,"_314":2063,"_161":773,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2061,"_161":1781,"_2051":2054,"_2052":2062},{"_92":2049,"_314":2050,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2060,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2058,"_161":1781,"_2051":2054,"_2052":2059},{"_92":2049,"_314":2056,"_161":1781,"_2051":2054,"_2052":2057},{"_92":2049,"_314":2053,"_161":1883,"_2051":2054,"_2052":2055},{"_92":2049,"_314":2050,"_161":-5,"_2051":-5,"_2052":-5},"pull_request_comment","\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `7aafe0c052`\n \n\n

ℹ️ About Codex in GitHub

","side","line","**_{_{![P1 Badge](https://img.shields.io/badge/P1-orange?style=flat)}} Give gh workflow run an explicit repository**\n\nIn this separate dispatch job there is no checkout step and no `GH_REPO`/`-R` repository context, while `gh workflow run` is one of the commands that otherwise operates on the local repository (the gh environment docs call out `GH_REPO` for this case). On the normal auto-release path this fresh job will therefore fail to determine the repository before it can dispatch `release.yml`, leaving the tag created but the GitHub Release unpublished; pass `-R \"${GITHUB_REPOSITORY}\"` or set `GH_REPO`.\n\nUseful? React with 👍 / 👎.","RIGHT",168,"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Check out the requested tag before reading notes**\n\nWhen this workflow is manually dispatched from the Actions UI or from `gh workflow run` without `--ref` matching `inputs.tag`, the checkout remains on the selected workflow ref (usually `main`) while `RELEASE_TAG` points at the requested tag. The tag target is validated, but `--notes-file docs/releases/${TAG}.md` is then read from the checked-out branch instead of the immutable tag, so a recovery run for an older tag can publish release notes from a later or unrelated commit; check out `RELEASE_TAG` or assert the checked-out commit matches it before using the notes file.\n\nUseful? React with 👍 / 👎.",37,"**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Avoid truncating paginated milestone output with head**\n\nWith `set -euo pipefail` enabled, this command substitution can abort even after the milestone was found: `gh api --paginate` continues traversing pages, so if the jq filter emits additional output after `head` exits, the producer can receive SIGPIPE and the whole assignment returns non-zero. In that scenario release publication fails instead of using the matched milestone; the same `| head -n 1` pattern is also present in `.github/workflows/auto-release-tag.yml`, so the lookup should select a single object inside jq/slurped JSON rather than relying on `head`.\n\nUseful? React with 👍 / 👎.",66,"## Self-Discovered Issue\n\n@codex second opinion requested.\n\n| Severity | Source | File | Lines | Issue | Mitigation |\n| --- | --- | --- | --- | --- | --- |\n| P2 | Self | `.github/workflows/auto-release-tag.yml`, `.github/workflows/release.yml` | milestone lookup commands | Paginated milestone lookup pipes through `head -n 1` while the script uses `set -euo pipefail`. If `gh api --paginate` writes additional output after `head` exits, the producer can receive SIGPIPE and the command substitution can fail even when the target milestone exists. | Replace `head`-based truncation with a single jq selection over the paginated stream, and add xtask coverage that milestone lookups do not depend on `head`. |","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Read release notes from the dispatched tag**\n\nWhen `workflow_dispatch` is run from `main` with an existing tag input (the natural recovery path after fixing a broken release workflow on `main`), this sets `TAG` to the input but leaves the workspace checked out at the dispatch ref, so `docs/releases/${TAG}.md` and the notes passed to `gh release create` can come from a later commit rather than the immutable tag that was just verified. Either check out the tag or read the notes via the tag object before publishing, otherwise a manual/recovery dispatch can publish release notes that do not match the tagged artifact.\n\nUseful? React with 👍 / 👎.",45,"**_{_{![P3 Badge](https://img.shields.io/badge/P3-lightgrey?style=flat)}} Query closed milestones in the runbook**\n\nIn the post-release verification path, this command is supposed to confirm the milestone was closed, but the GitHub List milestones endpoint defaults `state` to `open` unless `state=closed` or `state=all` is set. After the workflow successfully closes the milestone, this command will return no row, so operators lose the closure evidence the next paragraph asks them to record.\n\nUseful? React with 👍 / 👎.","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Select the repo when dispatching releases**\n\nWhen the auto-release path reaches this job, it has not run `actions/checkout`, so `gh workflow run` has no local Git remote from which to infer the repository. The GitHub CLI docs list `-R/--repo` for `gh workflow run` and say `GH_REPO` specifies the repository for commands that otherwise operate on a local repo; `GH_TOKEN` only authenticates. As written, the job can create the tag successfully and then fail to dispatch `release.yml` unless `GH_REPO: ${{ github.repository }}` or `--repo \"${GITHUB_REPOSITORY}\"` is provided.\n\nUseful? React with 👍 / 👎.","**Actionable comments posted: 3**\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (2)

\n> \n>
\n>
docs/topics/release-process/runbook.md (1)
\n> \n> `134-139`: _🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Use the real milestone query contract here.**\n> \n> This command is wrong for the post-release state it asks operators to verify. Without `state=all`, it will usually return nothing once the workflow has closed the milestone, and without pagination it can miss older milestones entirely. Match the workflow’s query instead.\n> \n>
\n>
Suggested fix
\n> \n> ```diff\n> -gh api repos/flyingrobots/edict/milestones --jq \\\n> - '.[] | select(.title == \"vX.Y.Z-alpha.N\") | {title,state,open_issues}'\n> +gh api --paginate \"repos/flyingrobots/edict/milestones?state=all&per_page=100\" --jq \\\n> + '.[] | select(.title == \"vX.Y.Z-alpha.N\") | {title,state,open_issues}'\n> ```\n>
\n> \n> As per coding guidelines, documentation is a product interface, not a Markdown inventory.\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@docs/topics/release-process/runbook.md` around lines 134 - 139, The milestone\n> verification command uses the wrong API contract for the post-release state;\n> update the runbook’s gh api query to match the workflow’s real milestone lookup\n> by requesting all states and handling pagination, then filter for the target\n> milestone title and closed/zero-open-issues result. Locate the command under the\n> release-process runbook near the milestone check, and make sure the documented\n> query aligns with the same contract used by the release workflow so operators\n> can still find closed milestones after release.\n> ```\n> \n>
\n> \n> \n> \n> _Source: Coding guidelines_\n> \n>
\n>
\n>
.github/workflows/release.yml (1)
\n> \n> `37-47`: _🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Check out the selected tag before reading release artifacts.**\n> \n> For `workflow_dispatch`, `RELEASE_TAG` comes from `inputs.tag`, but the workspace remains the manually selected dispatch ref. That can publish `docs/releases/${TAG}.md` from `main` or another branch instead of the immutable tag being released.\n> \n> \n> \n> \n> \n>
\n>
Proposed fix
\n> \n> ```diff\n> TAG=\"${RELEASE_TAG}\"\n> VERSION=\"${TAG#v}\"\n> - NOTES=\"docs/releases/${TAG}.md\"\n> - TAG_COMMIT=\"$(git rev-parse \"${TAG}^{commit}\")\"\n> \n> if [[ ! \"${TAG}\" =~ ^v[0-9]+\\.[0-9]+\\.[0-9]+(-[0-9A-Za-z.]+)?$ ]]; then\n> echo \"::error::Release tag must look like a SemVer v* tag: ${TAG}\"\n> exit 1\n> fi\n> +\n> + TAG_COMMIT=\"$(git rev-parse \"${TAG}^{commit}\")\"\n> @@\n> if ! git merge-base --is-ancestor \"${TAG_COMMIT}\" origin/main; then\n> echo \"::error::Release tags must target commits reachable from origin/main.\"\n> echo \"::error::Tag ${TAG} targets ${TAG_COMMIT}, which is not on origin/main.\"\n> exit 1\n> fi\n> +\n> + git checkout --detach \"${TAG_COMMIT}\"\n> + NOTES=\"docs/releases/${TAG}.md\"\n> ```\n> \n>
\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In @.github/workflows/release.yml around lines 37 - 47, The release workflow\n> reads release notes from the current workspace, but when RELEASE_TAG comes from\n> inputs.tag in workflow_dispatch it may still be on the dispatch ref instead of\n> the immutable tag. Update the release job so the checked-out revision matches\n> TAG before using NOTES or TAG_COMMIT, and keep the logic centered around\n> RELEASE_TAG, TAG, and TAG_COMMIT in the release shell step.\n> ```\n> \n>
\n> \n> \n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nInline comments:\nIn @.github/workflows/auto-release-tag.yml:\n- Around line 99-102: The checkout in the auto-release tagging workflow is\npersisting write credentials on disk, so update the existing actions/checkout\nstep to disable credential persistence with persist-credentials: false. Then\nharden the Create immutable release tag step by removing any reliance on cached\ngit auth and using explicit per-command authentication for the git ls-remote,\nfetch, and push operations, referring to the checkout and release-tagging logic\nso the token is only used transiently in each command.\n\nIn `@xtask/src/main.rs`:\n- Around line 925-933: The release workflow test is too broad because\nrelease_workflow_paginates_milestone_lookup only checks for any gh api\n--paginate usage instead of the milestone lookup specifically. Tighten the\nassertion in xtask/src/main.rs so it matches the milestone lookup command in\nrelease.yml, using the existing release_workflow_paginates_milestone_lookup test\nand workflow content to verify the paginated call is tied to milestone retrieval\nrather than any unrelated API call.\n- Around line 973-990: The auto-release workflow permission test is too weak\nbecause it only checks for strings anywhere in the YAML, so it can miss\npermissions leaking to a broader scope. Update\nauto_release_tag_workflow_scopes_job_permissions to parse and inspect the\nworkflow structure for the specific job entries identify-release-pr,\ncreate-release-tag, and dispatch-release-publication, and assert their job-local\npermissions exactly match the expected scoped values rather than just containing\nthe text. Use the existing workflow-loading logic in xtask/src/main.rs to locate\nthe job definitions and verify the permissions map for each job.\n\n---\n\nOutside diff comments:\nIn @.github/workflows/release.yml:\n- Around line 37-47: The release workflow reads release notes from the current\nworkspace, but when RELEASE_TAG comes from inputs.tag in workflow_dispatch it\nmay still be on the dispatch ref instead of the immutable tag. Update the\nrelease job so the checked-out revision matches TAG before using NOTES or\nTAG_COMMIT, and keep the logic centered around RELEASE_TAG, TAG, and TAG_COMMIT\nin the release shell step.\n\nIn `@docs/topics/release-process/runbook.md`:\n- Around line 134-139: The milestone verification command uses the wrong API\ncontract for the post-release state; update the runbook’s gh api query to match\nthe workflow’s real milestone lookup by requesting all states and handling\npagination, then filter for the target milestone title and\nclosed/zero-open-issues result. Locate the command under the release-process\nrunbook near the milestone check, and make sure the documented query aligns with\nthe same contract used by the release workflow so operators can still find\nclosed milestones after release.\n```\n\n

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Organization UI\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `1c4faddc-db6d-4c68-a415-559708a4ad5e`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between 87f394073787aa0a555a5b503ed2ea8e8e911bd5 and 7aafe0c052bdd26913b44c1cb9c65f1c7c2f73ec.\n\n

\n\n

📒 Files selected for processing (5)

\n\n* `.github/workflows/auto-release-tag.yml`\n* `.github/workflows/release.yml`\n* `docs/topics/release-process/policy.toml`\n* `docs/topics/release-process/runbook.md`\n* `xtask/src/main.rs`\n\n

\n\n

📜 Review details

\n\n

🧰 Additional context used

\n\n

📓 Path-based instructions (1)

\n\n

\n\n\n**⚙️ CodeRabbit configuration file**\n\n> `**`: # AGENTS\n> \n> ## Git Rules\n> \n> NEVER amend git commits. Make a new commit instead.\n> \n> NEVER use `git rebase` unless the user explicitly approves a rare exception.\n> Use regular merge commits.\n> \n> NEVER force any git operation. If a force operation appears necessary, stop and\n> explain what happened and what options remain.\n> \n> NEVER create draft pull requests.\n> \n> NEVER use a `codex` prefix in branch names, PR titles, or commit messages.\n> \n> Pull request bodies for issue work MUST include GitHub auto-close text such as\n> `Closes `#123`` for every issue the PR is intended to close.\n> \n> ## Think\n> \n> Think is durable memory for cross-session coordination.\n> \n> - Use `codex-think --remember --json` when starting a new session, changing into\n> this repository, or regaining context after a context shift.\n> - Use `codex-think \"...\" --json` when a cycle closes or a significant event\n> should survive across turns.\n> - Treat Think as memory, not repo truth. Anchor strong claims back to files,\n> commits, commands, issues, or pull requests.\n> - Claude memories are read-only. Use `claude-think --remember --json` only for\n> additional context.\n> \n> ## Topic Shelves\n> \n> `docs/topics/` contains the living contract graph for landed behavior. Topic\n> shelves are not proposals, retrospectives, or design archaeology.\n> \n> Each shelf may contain:\n> \n> - `README.md`: what is true in HEAD.\n> - `test-plan.md`: how those truths are verified, including requirements, cases,\n> fixtures, oracles, implemented evidence, planned cases, and known gaps.\n> - `architecture.md`: optional structure or dataflow notes when the machinery\n> earns a separate page.\n> - `rationale.md`: optional still-relevant tradeoffs and rejected approaches.\n> \n> ### When To Update Topic Shelves\n> \n> For every nontrivial behavior, contract, workflow, release, schema, validation,\n> or public-surface change:\n> \n> 1. Identify the owning topic shelf before editing code.\n> 2. If no shelf owns durable behavior, create one.\n> 3. Update `test-plan.md` before or alongside tests with requirement IDs, case\n> IDs,...\n\nFiles:\n- `docs/topics/release-process/policy.toml`\n- `docs/topics/release-process/runbook.md`\n- `xtask/src/main.rs`\n\n

\n\n

🪛 zizmor (1.26.1)

\n\n

.github/workflows/auto-release-tag.yml

\n\n

🔇 Additional comments (3)

\n\n
\n
.github/workflows/auto-release-tag.yml (2)
\n\n`10-88`: LGTM!\n\n\n\n---\n\n`150-168`: LGTM!\n\n\n\n
\n
\n
.github/workflows/release.yml (1)
\n\n`65-87`: LGTM!\n\n\n\nAlso applies to: 95-142\n\n\n\n
\n\n

\n\n

\n\n","_🔒 Security & Privacy_ | _🟠 Major_ | _⚡ Quick win_\n\n**These permission checks do not prove job-local least privilege.**\n\nThis test only checks that the file mentions the job names and permission strings somewhere. It still passes if `actions: write` or `contents: write` moves to a broader scope, which is exactly the regression this guard is supposed to catch.\n\n

Suggested hardening

\n\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n fn auto_release_tag_workflow_scopes_job_permissions() {\n let root = repo_root().expect(\"repo root\");\n let workflow = fs::read_to_string(root.join(\".github/workflows/auto-release-tag.yml\"))\n .expect(\"auto release workflow\");\n let identify_start = workflow\n .find(\"identify-release-pr:\")\n .expect(\"identify-release-pr job must exist\");\n let create_start = workflow\n .find(\"create-release-tag:\")\n .expect(\"create-release-tag job must exist\");\n let dispatch_start = workflow\n .find(\"dispatch-release-publication:\")\n .expect(\"dispatch-release-publication job must exist\");\n\n let identify_job = &workflow[identify_start..create_start];\n let create_job = &workflow[create_start..dispatch_start];\n let dispatch_job = &workflow[dispatch_start..];\n\n assert!(\n identify_job.contains(\"contents: read\")\n && identify_job.contains(\"pull-requests: read\"),\n \"identify-release-pr must stay read-only\"\n );\n assert!(\n create_job.contains(\"contents: write\"),\n \"create-release-tag must retain tag-write permission\"\n );\n assert!(\n dispatch_job.contains(\"actions: write\"),\n \"dispatch-release-publication must retain workflow-dispatch permission\"\n );\n }\n```\n\n

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@xtask/src/main.rs` around lines 973 - 990, The auto-release workflow\npermission test is too weak because it only checks for strings anywhere in the\nYAML, so it can miss permissions leaking to a broader scope. Update\nauto_release_tag_workflow_scopes_job_permissions to parse and inspect the\nworkflow structure for the specific job entries identify-release-pr,\ncreate-release-tag, and dispatch-release-publication, and assert their job-local\npermissions exactly match the expected scoped values rather than just containing\nthe text. Use the existing workflow-loading logic in xtask/src/main.rs to locate\nthe job definitions and verify the permissions map for each job.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits e6ab7cc to ca19915",1089,"_📐 Maintainability & Code Quality_ | _🟠 Major_ | _⚡ Quick win_\n\n**Bind the pagination check to the milestone lookup, not any random API call.**\n\nLine 931 only proves `release.yml` contains some `gh api --paginate`. An unrelated paginated call would satisfy this while milestone lookup silently regressed back to a single page.\n\n

Suggested hardening

\n\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@xtask/src/main.rs` around lines 925 - 933, The release workflow test is too\nbroad because release_workflow_paginates_milestone_lookup only checks for any gh\napi --paginate usage instead of the milestone lookup specifically. Tighten the\nassertion in xtask/src/main.rs so it matches the milestone lookup command in\nrelease.yml, using the existing release_workflow_paginates_milestone_lookup test\nand workflow content to verify the paginated call is tied to milestone retrieval\nrather than any unrelated API call.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits e6ab7cc to ca19915",974,"_🔒 Security & Privacy_ | _🟠 Major_\n\n**Kill the persisted `contents: write` suicide pact immediately; harden with `persist-credentials: false` and explicit ephemeral auth.**\n\nThe `actions/checkout` action defaults to `persist-credentials: true`, which scrawls your elevated `GITHUB_TOKEN` directly into the runner's local git config. While the `auto-release-tag.yml` workflow currently restricts scope to a single job, leaving a write-token on the workspace disk is negligence. It transforms a controlled network operation into a persistent filesystem liability.\n\nSanitize the checkout at **Lines 99–102** to strip credential persistence:\n\n```diff\n - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0\n with:\n ref: ${{ needs.identify-release-pr.outputs.sha }}\n fetch-depth: 0\n+ persist-credentials: false\n```\n\nUpdate the **`Create immutable release tag`** step (Lines 132–147) to inject authentication strictly on a per-command basis:\n\n1. Pass the bearer token via `git -c` for `ls-remote`, `fetch`, and `push`.\n2. Do **not** rely on the runner's cached credentials.\n\nThe token lives only in the runner's memory for the exact duration of the network call. Execute immediately.\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🧰 Tools

\n\n

🪛 zizmor (1.26.1)

\n\n[warning] 99-102: credential persistence through GitHub Actions artifacts (artipacked): does not set persist-credentials: false\n\n(artipacked)\n\n

\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/auto-release-tag.yml around lines 99 - 102, The checkout\nin the auto-release tagging workflow is persisting write credentials on disk, so\nupdate the existing actions/checkout step to disable credential persistence with\npersist-credentials: false. Then harden the Create immutable release tag step by\nremoving any reliance on cached git auth and using explicit per-command\nauthentication for the git ls-remote, fetch, and push operations, referring to\nthe checkout and release-tagging logic so the token is only used transiently in\neach command.\n```\n\n

\n\n\n\n\n\n",102,"## Activity Summary\n\n@codex second opinion requested on the resolved review queue.\n\n| # | Severity | Source | File | Commit | Outcome |\n| --- | --- | --- | --- | --- | --- |\n| 1 | P2 | PR | `.github/workflows/auto-release-tag.yml` | `1bbc598` | Split auto-release into scoped identify/tag/dispatch jobs with least privilege. |\n| 2 | P2 | PR | `.github/workflows/auto-release-tag.yml` | `3d6f79d` | Checked matching milestone and zero open issues before creating immutable tags. |\n| 3 | P2 | PR | `.github/workflows/auto-release-tag.yml` | `4699430` | Dispatches `release.yml` from the created tag ref instead of moving `main`. |\n| 4 | P2 | PR | `docs/topics/release-process/runbook.md` | `d4ef31e` | Manual fallback now tags an explicit verified main merge commit. |\n| 5 | P2 | PR | `.github/workflows/release.yml` | `e646f5f` | Release milestone lookup now paginates all milestone pages. |\n| 6 | P3 | PR | `xtask/src/main.rs` | `01fe756` | Release workflow test now asserts publish-before-milestone-close ordering and output wiring. |\n| 7 | P3 | PR | `xtask/src/main.rs` | `8c9f779` | Auto-release test and policy now assert the `workflow_run.event == 'push'` guard. |\n| 8 | P5 | Verify | `xtask/src/main.rs` | `7aafe0c` | Applied required `cargo fmt` formatting follow-up without amending prior commits. |\n\nValidation:\n\n- `actionlint`\n- `git diff --check origin/main...HEAD`\n- `cargo test -p xtask release_`\n- `cargo xtask verify`\n\nAll previously unresolved review threads were resolved via GraphQL after the fixes were pushed.","\n### 💡 Codex Review\n\nHere are some automated review suggestions for this pull request.\n\n**Reviewed commit:** `87f3940737`\n \n\n

ℹ️ About Codex in GitHub

","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Pin manual fallback to the verified merge commit**\n\nIf automation fails and the operator follows this fallback from their release branch or a stale local `main`, `git tag` tags the current `HEAD`, not necessarily the release-prep merge commit that passed `main` CI. Because the Release workflow only checks that the tag target is reachable from `origin/main`, it would accept an older main ancestor or the PR head from a merge commit, leaving an immutable release tag on the wrong commit; the fallback should fetch `origin/main` and tag the verified merge SHA explicitly.\n\nUseful? React with 👍 / 👎.","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Check the milestone before pushing the immutable tag**\n\nWhen a `release/*-prep` PR is merged while the matching milestone still has open issues, this step creates and pushes the immutable release tag before `release.yml` gets a chance to enforce the zero-open-milestone gate. The later Release run will fail, but the tag is already on a commit that did not pass the release gate, and the documented policy forbids moving or recreating it; run the milestone check before `git tag`/`git push` so a not-ready release does not leave behind an unusable durable tag.\n\nUseful? React with 👍 / 👎.","**_{_{![P2 Badge](https://img.shields.io/badge/P2-yellow?style=flat)}} Dispatch releases from the tagged ref**\n\nIn the auto-release path, `gh workflow run --ref main` starts the Release workflow from whatever `main` points at when the dispatch is processed; the gh manual defines `--ref` as the branch or tag containing the workflow version. If another commit lands on `main` after CI succeeded for the release merge but before this dispatch runs, `release.yml` checks out that newer commit and reads `docs/releases/${TAG}.md` from it while publishing the tag created at `SHA`, so the release can use notes or workflow guards that were not on the verified tagged commit. Dispatch the workflow at `${TAG}` or make `release.yml` explicitly check out the tagged SHA for this automated path.\n\nUseful? React with 👍 / 👎.","**Actionable comments posted: 4**\n\n> [!CAUTION]\n> Some comments are outside the diff and can’t be posted inline due to platform limitations.\n> \n> \n> \n>

\n>

⚠️ Outside diff range comments (1)

\n> \n>
\n>
docs/topics/release-process/runbook.md (1)
\n> \n> `103-110`: _🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\n> \n> **Anchor the fallback tag to refreshed `main`, not implicit `HEAD`.**\n> \n> Line 103 removes the old “refresh local `main` first” guard, but the fallback still uses `git tag -a ...` with no target. If an operator runs this from a stale checkout or the old `release/...-prep` branch, the tag can land on the wrong commit, and `release.yml` would still accept any older commit that is merely reachable from `origin/main`.\n> \n> As per coding guidelines, “Documentation is a product interface, not a Markdown inventory.”\n> \n> \n> \n>
\n>
Suggested fix
\n> \n> ```diff\n> Manual tagging is now an operator fallback, not the normal path. If automation\n> does not run and the release-prep merge commit has been verified on `main`, the\n> fallback is:\n> \n> ```bash\n> +git switch main\n> +git fetch origin\n> +git merge --ff-only origin/main\n> -git tag -a vX.Y.Z-alpha.N -m \"vX.Y.Z-alpha.N\"\n> +git tag -a vX.Y.Z-alpha.N origin/main -m \"vX.Y.Z-alpha.N\"\n> git push origin vX.Y.Z-alpha.N\n> ```\n> ```\n>
\n> \n>
\n>
🤖 Prompt for AI Agents
\n> \n> ```\n> Verify each finding against current code. Fix only still-valid issues, skip the\n> rest with a brief reason, keep changes minimal, and validate.\n> \n> In `@docs/topics/release-process/runbook.md` around lines 103 - 110, The fallback\n> tagging step in the release-process runbook can tag the wrong commit because\n> `git tag -a` is currently using the operator’s implicit `HEAD`. Update the\n> instructions around the manual fallback to first refresh local `main` from\n> `origin/main` (for example via the existing release flow context), then make\n> `git tag -a` explicitly point at `origin/main` so the tag is anchored to the\n> verified commit. Use the existing release-prep fallback section and the `git tag\n> -a` / `git push origin` steps as the place to adjust the guidance.\n> ```\n> \n>
\n> \n> \n> \n> _Source: Coding guidelines_\n> \n>
\n> \n>

\n\n

🤖 Prompt for all review comments with AI agents

\n\n

🪄 Autofix (Beta)

\n\nFix all unresolved CodeRabbit comments on this PR:\n\n- [ ] Push a commit to this branch (recommended)\n- [ ] Create a new PR with the fixes\n\n

\n\n---\n\n

ℹ️ Review info

\n\n

⚙️ Run configuration

\n\n**Configuration used**: Organization UI\n\n**Review profile**: ASSERTIVE\n\n**Plan**: Pro\n\n**Run ID**: `9e7a759d-bc04-4541-bea9-7fa80f31de67`\n\n

\n\n

📥 Commits

\n\nReviewing files that changed from the base of the PR and between dcd5677c3710d0869009d2e82a6da1bf4175cc8a and 87f394073787aa0a555a5b503ed2ea8e8e911bd5.\n\n

\n\n

⛔ Files ignored due to path filters (1)

\n\n* `Cargo.lock` is excluded by `!**/*.lock`\n\n

\n\n

📒 Files selected for processing (13)

\n\n

📜 Review details

\n\n

🧰 Additional context used

\n\n

📓 Path-based instructions (3)

\n\n

docs/topics/**/README.md

docs/topics/**/test-plan.md

\n\n

🪛 LanguageTool

\n\n

docs/topics/release-process/README.md

docs/topics/release-process/runbook.md

docs/topics/release-process/test-plan.md

\n\n

🪛 zizmor (1.26.1)

\n\n

.github/workflows/release.yml

.github/workflows/auto-release-tag.yml

\n\n

🔇 Additional comments (8)

\n\n
\n
docs/releases/v0.5.0-alpha.1.md (1)
\n\n`1-96`: LGTM!\n\n\n\n
\n
\n
crates/edict-syntax/Cargo.toml (1)
\n\n`3-3`: LGTM!\n\n\n\n
\n
\n
CHANGELOG.md (1)
\n\n`11-12`: LGTM!\n\n\n\n
\n
\n
README.md (1)
\n\n`462-465`: LGTM!\n\n\n\nAlso applies to: 494-495, 514-524\n\n\n\n
\n
\n
ROADMAP.md (1)
\n\n`180-181`: LGTM!\n\n\n\nAlso applies to: 195-195, 247-247\n\n\n\n
\n
\n
docs/README.md (1)
\n\n`16-19`: LGTM!\n\n\n\n
\n
\n
.github/workflows/auto-release-tag.yml (1)
\n\n`29-83`: LGTM!\n\n\n\nAlso applies to: 84-113, 115-124\n\n\n\n
\n
\n
.github/workflows/release.yml (1)
\n\n`7-53`: LGTM!\n\n\n\nAlso applies to: 73-87, 95-123, 124-142\n\n\n\n
\n\n

\n\n

\n\n","_🗄️ Data Integrity & Integration_ | _🟠 Major_ | _⚡ Quick win_\n\n**Assert the `workflow_run.event == 'push'` gate too.**\n\nLine 912 only checks for successful CI. If `.github/workflows/auto-release-tag.yml` lost the `github.event.workflow_run.event == 'push'` predicate, this test would still pass and the auto-tagger could start reacting to non-post-merge CI runs instead of only merged-into-`main` runs.\n\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\n\n \n\n

Suggested fix

\n\n\n\n

📝 Committable suggestion

\n\n> ‼️ **IMPORTANT**\n> Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.\n\n```suggestion\n fn auto_release_tag_workflow_is_guarded() {\n let root = repo_root().expect(\"repo root\");\n let workflow = fs::read_to_string(root.join(\".github/workflows/auto-release-tag.yml\"))\n .expect(\"auto release workflow\");\n for needle in [\n \"workflow_run:\",\n \"workflows: [\\\"CI\\\"]\",\n \"branches: [main]\",\n \"github.event.workflow_run.conclusion == 'success'\",\n \"github.event.workflow_run.event == 'push'\",\n \"/commits/${SHA}/pulls\",\n \"^release/v[0-9]+\",\n \"docs/releases/${TAG}.md\",\n \"git tag -a\",\n \"refusing to move\",\n \"gh workflow run release.yml\",\n \"actions: write\",\n ] {\n assert!(\n workflow.contains(needle),\n \"auto release workflow missing guard/action: {needle}\"\n );\n }\n assert!(\n !workflow.contains(\"--force\"),\n \"auto release workflow must not force any git operation\"\n );\n```\n\n

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn `@xtask/src/main.rs` around lines 904 - 929, The auto-release workflow guard\ntest is missing coverage for the push-event predicate, so update\nauto_release_tag_workflow_is_guarded in xtask/src/main.rs to also assert the\nworkflow contains github.event.workflow_run.event == 'push'. Keep the existing\nchecks around workflow_run, CI, main, and success, but add the missing guard\nstring so the test fails if the auto-tagger starts reacting to non-merge CI\nruns.\n```\n\n

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits 1bbc598 to 7aafe0c",1006,"_🎯 Functional Correctness_ | _🟠 Major_ | _⚡ Quick win_\n\n**This guard does not prove milestone closure happens after publication.**\n\nThe test only checks for milestone-related substrings. A workflow that moved `Close release milestone` above `Publish GitHub release`, or stopped wiring the close step to `steps.release.outputs.*`, would still pass while violating RELEASE-REQ-013 and the implemented oracle in `docs/topics/release-process/test-plan.md`.\n\nAs per coding guidelines, tests must assert software behavior and stable contract artifacts, not just incidental text.\n\n \n\n

Suggested hardening

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n\n\n\n\n\n\n_Source: Coding guidelines_\n\n\n\n✅ Addressed in commits 1bbc598 to 7aafe0c",975,"_🗄️ Data Integrity & Integration_ | _🟠 Major_\n\n**The release gate will catastrophically fail any repository with a history exceeding 100 milestones.**\n\nThe GitHub API enforces pagination. Without the `--paginate` flag, `gh api` returns only the first page. Consequently, if the target milestone resides beyond the 100th record, the lookup returns empty, triggering a spurious `exit 1` that blocks valid releases. This is brittle engineering that ignores the reality of long-lived repositories. The `--paginate` flag is mandatory to traverse the full dataset.\n\n

Required Fix

\n\n```diff\n MILESTONE_JSON=\"$(gh api \"repos/${GITHUB_REPOSITORY}/milestones?state=all&per_page=100\" \\\n+ --paginate \\\n --jq \".[] | select(.title == \\\"${TAG}\\\")\")\"\n```\n\n

\n\n\n\n

📝 Committable suggestion

\n\n\n\n

🤖 Prompt for AI Agents

\n\n```\nVerify each finding against current code. Fix only still-valid issues, skip the\nrest with a brief reason, keep changes minimal, and validate.\n\nIn @.github/workflows/release.yml around lines 65 - 66, The milestone lookup in\nthe release workflow is only querying the first page of GitHub results, so it\ncan miss the target milestone in long-lived repositories. Update the gh api call\nin the release job to use pagination so the milestone search in the\nMILESTONE_JSON assignment traverses all pages before the jq filter runs, keeping\nthe existing TAG-based lookup intact.\n```\n\n

\n\n\n\n\n\n\n\n✅ Addressed in commits 1bbc598 to 7aafe0c","_🔒 Security & Privacy_ | _🟠 Major_\n\n

🧩 Analysis chain

\n\n🏁 Script executed:\n\n```shell\ncat -n .github/workflows/auto-release-tag.yml\n```\n\nRepository: flyingrobots/edict\n\nLength of output: 5007\n\n---\n\n\n\n

🧰 Tools

\n\n

🪛 zizmor (1.26.1)

\n\n

🤖 Prompt for AI Agents

\n\n\n\n\n\n_Source: Linters/SAST tools_\n\n\n\n✅ Addressed in commits 1bbc598 to 7aafe0c","\n\n\n[![Review Change Stack](https://storage.googleapis.com/coderabbit_public_assets/review-stack-in-coderabbit-ui.svg)](https://app.coderabbit.ai/change-stack/flyingrobots/edict/pull/43?utm_source=github_walkthrough&utm_medium=github&utm_campaign=change_stack)\n\n\n\n\n> [!NOTE]\n> Currently processing new changes in this PR. This may take a few minutes, please wait...\n> \n>

\n>

⚙️ Run configuration

\n> \n> **Configuration used**: Organization UI\n> \n> **Review profile**: ASSERTIVE\n> \n> **Plan**: Pro\n> \n> **Run ID**: `d7341a97-9596-41e8-9b7b-c8ab8fd80e15`\n> \n>

\n> \n>

\n>

📥 Commits

\n> \n> Reviewing files that changed from the base of the PR and between 7aafe0c052bdd26913b44c1cb9c65f1c7c2f73ec and ca19915713018576089f4d9c44ed32a2c79d902f.\n> \n>

\n> \n>

\n>

📒 Files selected for processing (5)

🚥 Pre-merge checks | ✅ 5

\n\n

✅ Passed checks (5 passed)

\n\n_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}\n\n

❤️ Share

\n\n\n_{Comment `@coderabbitai help` to get the list of available commands.}\n\n","base_ref","head_ref","pull_request_info",[2089],{"_754":46,"_46":2090},"@codex Activity Summary for the latest Code Lawyer pass.\n\n| Source | Severity | File(s) | Commit(s) | Outcome |\n| --- | --- | --- | --- | --- |\n| PR | P2 | `.github/workflows/auto-release-tag.yml`, `xtask/src/main.rs` | `e6ab7cc`, `3e19e44` | Disabled checkout credential persistence and moved tag-job Git network operations to explicit per-command ephemeral auth. |\n| PR | P2 | `.github/workflows/auto-release-tag.yml`, `xtask/src/main.rs` | `71a1f0e` | Added explicit repository context for `gh workflow run` in the dispatch-only job. |\n| PR | P2 | `.github/workflows/release.yml`, `xtask/src/main.rs` | `e4fd041` | Made manual release dispatch check out the tag being published before reading release notes. |\n| PR | P3 | `docs/topics/release-process/runbook.md`, `docs/topics/release-process/policy.toml`, `xtask/src/main.rs` | `922d1c4` | Updated post-release milestone verification to query paginated all-state milestones. |\n| PR | P3 | `xtask/src/main.rs`, `docs/topics/release-process/policy.toml` | `8c7c413` | Bound the pagination regression to the release milestone lookup contract instead of any paginated API call. |\n| PR | P3 | `xtask/src/main.rs`, `docs/topics/release-process/policy.toml` | `091f0a0` | Hardened release permission tests to inspect top-level and job-local permission blocks. |\n| Self | P2 | `.github/workflows/release.yml`, `.github/workflows/auto-release-tag.yml`, `docs/topics/release-process/policy.toml`, `xtask/src/main.rs` | `2cbd99b` | Removed `head`-based paginated milestone selection under `pipefail`; both workflows now consume the full stream before selecting the first match. |\n| Self | P5 | `xtask/src/main.rs` | `ca19915` | Formatter-only cleanup required by `cargo fmt --all --check`. |\n\nValidation run on the final head `3e19e44`:\n\n- `actionlint`\n- `git diff --check origin/main...HEAD`\n- `cargo test -p xtask release_`\n- `cargo xtask verify`\n\nAll previously unresolved PR review threads were resolved via GraphQL after the fixes landed.\n",[2353,2354],[],{"_759":760,"_46":761,"_762":763},{"_733":2344},{"_336":2343},{"_336":2126},{"_304":305,"_295":306,"_307":308,"_309":15,"_310":59,"_311":15,"_312":313,"_314":315,"_316":267,"_317":127,"_318":319,"_320":129,"_321":322,"_323":-5,"_324":-5,"_325":2125,"_327":328,"_329":330,"_331":332,"_333":334},{"_42":123,"_193":194,"_195":196,"_197":15,"_198":199,"_200":201,"_202":2114,"_204":-5,"_205":206,"_207":15,"_208":2115,"_210":199,"_211":199,"_212":2116,"_214":2117,"_216":2118,"_218":-5,"_219":220,"_221":222,"_223":224,"_225":2119,"_55":-5,"_119":227,"_228":2120,"_230":2121,"_232":233,"_234":15,"_235":15},{"_133":2107},[2101,2102,2103,2104,2105,2106],{"_148":171,"_150":165,"_152":166,"_154":163,"_156":172,"_158":159,"_160":32,"_161":-5},{"_148":170,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":168,"_150":165,"_152":166,"_154":163,"_156":169,"_158":159,"_160":32,"_161":-5},{"_148":164,"_150":165,"_152":166,"_154":163,"_156":167,"_158":159,"_160":32,"_161":-5},{"_148":162,"_150":151,"_152":153,"_154":163,"_156":157,"_158":159,"_160":32,"_161":-5},{"_148":149,"_150":151,"_152":153,"_154":155,"_156":157,"_158":159,"_160":32,"_161":-5},[2108,2109,2110],{"_177":2113,"_179":190},{"_177":2112,"_179":186},{"_177":2111,"_179":180},{"_181":182,"_92":183,"_119":184},{"_181":187,"_92":183,"_119":188},{"_181":191,"_92":183,"_119":192},{"_297":298,"_299":-5,"_300":-5,"_301":-5,"_302":-5,"_303":-5},[257],{"_257":2122},{"_239":240,"_241":242,"_243":244,"_245":246,"_247":248,"_249":250,"_251":252,"_253":254,"_255":256},{},[],{"_238":59},{"_236":59,"_237":199},{"_42":259,"_181":260,"_261":2123,"_263":196,"_264":265,"_266":267,"_268":269,"_270":271,"_272":273,"_274":64,"_275":15,"_276":-5,"_277":-5,"_278":-5,"_279":-5,"_280":-5,"_281":-5,"_160":282,"_283":-5,"_55":2124},{"_289":290,"_42":291,"_92":292,"_293":294,"_295":296},{"_285":15,"_286":15,"_287":15,"_288":15},{"_289":290,"_181":290,"_335":-5,"_293":294,"_42":291},[2127,2128,2129,2130,2131,2132,2133,2134,2135,2136,2137,2138,2139,2140,2141,2142,2143,2144,2145,2146,2147,2148,2149,2150,2151,2152,2153,2154,2155,2156,2157,2158,2159,2160,2161,2162,2163,2164,2165,2166,2167,2168,2169,2170,2171,2172,2173,2174,2175,2176,2177,2178,2179,2180],{"_154":705,"_393":2339},{"_154":408,"_393":2336},{"_154":695,"_393":2333},{"_154":412,"_393":2328},{"_154":412,"_393":2323},{"_154":412,"_393":2319},{"_154":427,"_393":2314},{"_154":427,"_393":2310},{"_154":412,"_393":2306},{"_154":412,"_393":2304},{"_154":412,"_393":2302},{"_154":412,"_393":2300},{"_154":427,"_393":2296},{"_154":427,"_393":2292},{"_154":412,"_393":2290},{"_154":412,"_393":2288},{"_154":427,"_393":2284},{"_154":412,"_393":2282},{"_154":427,"_393":2278},{"_154":412,"_393":2275},{"_154":412,"_393":2273},{"_154":427,"_393":2269},{"_154":412,"_393":2267},{"_154":427,"_393":2263},{"_154":412,"_393":2259},{"_154":412,"_393":2257},{"_154":412,"_393":2255},{"_154":412,"_393":2253},{"_154":427,"_393":2249},{"_154":412,"_393":2247},{"_154":427,"_393":2243},{"_154":412,"_393":2241},{"_154":412,"_393":2239},{"_154":427,"_393":2235},{"_154":412,"_393":2232},{"_154":412,"_393":2230},{"_154":412,"_393":2228},{"_154":412,"_393":2226},{"_154":412,"_393":2224},{"_154":412,"_393":2222},{"_154":412,"_393":2220},{"_154":427,"_393":2216},{"_154":412,"_393":2214},{"_154":427,"_393":2210},{"_154":412,"_393":2208},{"_154":412,"_393":2206},{"_154":427,"_393":2202},{"_154":412,"_393":2200},{"_154":427,"_393":2196},{"_154":412,"_393":2192},{"_154":427,"_393":2190},{"_154":412,"_393":2186},{"_154":408,"_393":2184},{"_154":392,"_393":2181},{"_395":396,"_87":2182},{"_398":399,"_400":401,"_103":-5,"_42":402,"_403":2183,"_405":406,"_407":113},[],{"_407":2185,"_395":396},{"_92":411},{"_414":2187,"_395":396,"_416":402},{"_417":2188,"_419":-5,"_42":-5,"_420":-5,"_421":422,"_96":93,"_92":423},[2189],{"_46":425,"_92":426},{"_414":2191,"_395":396,"_416":402},{"_42":430,"_421":422,"_46":425,"_92":431},{"_414":2193,"_395":396,"_416":402},{"_417":-5,"_434":435,"_42":-5,"_420":-5,"_436":2194,"_92":438},[2195],{"_46":440,"_92":441},{"_414":2197,"_395":396,"_416":402},{"_417":2198,"_42":445,"_436":2199,"_92":438},[],[440],{"_414":2201,"_395":396,"_416":402},{"_449":450,"_42":-5,"_420":-5,"_451":452,"_92":453},{"_414":2203,"_395":396,"_416":402},{"_456":457,"_458":459,"_460":2204,"_462":463,"_400":32,"_464":32,"_42":450,"_465":466,"_467":468,"_407":113,"_92":469},[2205],{"_458":471,"_92":472},{"_414":2207,"_395":396,"_416":402},{"_475":476,"_449":450,"_42":-5,"_420":-5,"_181":477,"_478":-5,"_92":479},{"_414":2209,"_395":396,"_416":402},{"_449":482,"_42":-5,"_420":-5,"_451":483,"_92":453},{"_414":2211,"_395":396,"_416":402},{"_456":486,"_458":487,"_460":2212,"_462":463,"_400":32,"_464":32,"_42":482,"_465":489,"_467":468,"_407":113,"_92":469},[2213],{"_458":491,"_92":472},{"_414":2215,"_395":396,"_416":402},{"_475":494,"_449":482,"_42":-5,"_420":-5,"_181":477,"_478":-5,"_92":479},{"_414":2217,"_395":396,"_416":402},{"_456":497,"_458":498,"_460":2218,"_462":463,"_400":500,"_464":32,"_42":501,"_465":502,"_467":468,"_407":113,"_92":469},[2219],{"_458":504,"_92":472},{"_414":2221,"_395":396,"_416":402},{"_449":507,"_42":-5,"_420":-5,"_451":508,"_92":453},{"_414":2223,"_395":396,"_416":402},{"_475":511,"_449":507,"_42":-5,"_420":-5,"_181":512,"_478":-5,"_92":479},{"_414":2225,"_395":396,"_416":402},{"_449":515,"_42":-5,"_420":-5,"_451":516,"_92":453},{"_414":2227,"_395":396,"_416":402},{"_475":511,"_449":515,"_42":-5,"_420":-5,"_181":512,"_478":-5,"_92":479},{"_414":2229,"_395":396,"_416":402},{"_449":521,"_42":-5,"_420":-5,"_451":522,"_92":453},{"_414":2231,"_395":396,"_416":402},{"_475":511,"_449":521,"_42":-5,"_420":-5,"_181":512,"_478":-5,"_92":479},{"_414":2233,"_395":396,"_416":402},{"_417":-5,"_434":527,"_42":-5,"_420":-5,"_436":2234,"_92":438},[],{"_414":2236,"_395":396,"_416":402},{"_417":2237,"_42":532,"_436":2238,"_92":438},[],[],{"_414":2240,"_395":396,"_416":402},{"_449":536,"_42":-5,"_420":-5,"_451":537,"_92":453},{"_414":2242,"_395":396,"_416":402},{"_449":501,"_42":-5,"_420":-5,"_451":540,"_92":453},{"_414":2244,"_395":396,"_416":402},{"_456":543,"_458":544,"_460":2245,"_462":463,"_400":546,"_464":547,"_42":536,"_465":548,"_467":468,"_407":549,"_92":469},[2246],{"_458":551,"_92":472},{"_414":2248,"_395":396,"_416":402},{"_449":554,"_42":-5,"_420":-5,"_451":555,"_92":453},{"_414":2250,"_395":396,"_416":402},{"_456":558,"_458":559,"_460":2251,"_462":463,"_400":32,"_464":561,"_42":554,"_465":562,"_467":468,"_407":549,"_92":469},[2252],{"_458":564,"_92":472},{"_414":2254,"_395":396,"_416":402},{"_475":567,"_449":536,"_42":-5,"_420":-5,"_181":477,"_478":-5,"_92":479},{"_414":2256,"_395":396,"_416":402},{"_475":570,"_449":501,"_42":-5,"_420":-5,"_181":477,"_478":-5,"_92":479},{"_414":2258,"_395":396,"_416":402},{"_475":573,"_449":554,"_42":-5,"_420":-5,"_181":477,"_478":-5,"_92":479},{"_414":2260,"_395":396,"_416":402},{"_417":-5,"_434":576,"_42":-5,"_420":-5,"_436":2261,"_92":438},[2262],{"_46":579,"_92":441},{"_414":2264,"_395":396,"_416":402},{"_417":2265,"_42":583,"_436":2266,"_92":438},[],[579],{"_414":2268,"_395":396,"_416":402},{"_449":587,"_42":-5,"_420":-5,"_451":588,"_92":453},{"_414":2270,"_395":396,"_416":402},{"_456":591,"_458":592,"_460":2271,"_462":463,"_400":32,"_464":32,"_42":587,"_465":594,"_467":468,"_407":113,"_92":469},[2272],{"_458":596,"_92":472},{"_414":2274,"_395":396,"_416":402},{"_475":599,"_449":587,"_42":-5,"_420":-5,"_181":477,"_478":-5,"_92":479},{"_414":2276,"_395":396,"_416":402},{"_417":-5,"_434":602,"_42":-5,"_420":-5,"_436":2277,"_92":438},[],{"_414":2279,"_395":396,"_416":402},{"_417":2280,"_42":607,"_436":2281,"_92":438},[],[],{"_414":2283,"_395":396,"_416":402},{"_449":611,"_42":-5,"_420":-5,"_451":612,"_92":453},{"_414":2285,"_395":396,"_416":402},{"_456":615,"_458":616,"_460":2286,"_462":463,"_400":32,"_464":32,"_42":611,"_465":618,"_467":468,"_407":113,"_92":469},[2287],{"_458":620,"_92":472},{"_414":2289,"_395":396,"_416":402},{"_449":623,"_42":-5,"_420":-5,"_451":624,"_92":453},{"_414":2291,"_395":396,"_416":402},{"_449":627,"_42":-5,"_420":-5,"_451":628,"_92":453},{"_414":2293,"_395":396,"_416":402},{"_456":631,"_458":632,"_460":2294,"_462":463,"_400":32,"_464":32,"_42":627,"_465":634,"_467":468,"_407":113,"_92":469},[2295],{"_458":636,"_92":472},{"_414":2297,"_395":396,"_416":402},{"_456":639,"_458":640,"_460":2298,"_462":463,"_400":32,"_464":547,"_42":623,"_465":642,"_467":468,"_407":549,"_92":469},[2299],{"_458":644,"_92":472},{"_414":2301,"_395":396,"_416":402},{"_475":647,"_449":611,"_42":-5,"_420":-5,"_181":477,"_478":-5,"_92":479},{"_414":2303,"_395":396,"_416":402},{"_475":650,"_449":623,"_42":-5,"_420":-5,"_181":477,"_478":-5,"_92":479},{"_414":2305,"_395":396,"_416":402},{"_475":653,"_449":627,"_42":-5,"_420":-5,"_181":477,"_478":-5,"_92":479},{"_414":2307,"_395":396,"_416":402},{"_417":-5,"_434":656,"_42":-5,"_420":-5,"_436":2308,"_92":438},[2309],{"_46":659,"_92":441},{"_414":2311,"_395":396,"_416":402},{"_417":2312,"_42":663,"_436":2313,"_92":438},[],[659],{"_414":2315,"_395":396,"_416":402},{"_667":-5,"_417":2316,"_42":669,"_92":670},[2317],{"_46":672,"_673":2318,"_92":46},[],{"_414":2320,"_395":396,"_416":402},{"_417":2321,"_419":-5,"_42":-5,"_420":-5,"_421":-5,"_96":325,"_92":423},[2322],{"_46":672,"_92":679},{"_414":2324,"_395":396,"_416":402},{"_417":2325,"_419":-5,"_42":-5,"_420":-5,"_421":-5,"_96":325,"_92":423},[2326,2327],{"_46":686,"_92":679},{"_46":685,"_92":679},{"_414":2329,"_395":396,"_416":402},{"_417":2330,"_419":-5,"_42":-5,"_420":-5,"_421":-5,"_96":690,"_92":423},[2331,2332],{"_46":694,"_92":679},{"_46":693,"_92":679},{"_395":396,"_87":2334},{"_103":-5,"_42":402,"_403":2335,"_405":406,"_407":699},[],{"_407":2337,"_395":396},{"_702":2338,"_92":704},[],{"_707":2340},{"_709":-5,"_710":-5,"_711":712,"_713":714,"_462":463,"_715":15,"_716":-5,"_717":-5,"_718":-5,"_719":720,"_42":396,"_721":722,"_181":-5,"_723":-5,"_161":724,"_725":199,"_726":-5,"_467":727,"_407":2341,"_729":-5,"_77":2342,"_731":714},{"_92":411},[],[],[2345],{"_42":736,"_737":2346,"_739":740,"_741":740,"_417":2347,"_407":743,"_419":-5,"_744":32,"_745":2348,"_747":748,"_749":-5},{"_96":325,"_181":-5,"_745":2352},{"_754":46,"_755":2351},{"_750":2349},{"_752":2350},[],[757],{},{"_92":423,"_96":93,"_417":2372},{"_92":766,"_767":2355},[2356,2357,2358,2359],{"_161":1883,"_774":-5,"_775":2369,"_777":-5},{"_161":1781,"_774":-5,"_775":2366,"_777":-5},{"_161":876,"_774":-5,"_775":2363,"_777":-5},{"_161":773,"_774":-5,"_775":2360,"_777":-5},[2361],{"_779":780,"_781":782,"_417":2362,"_784":59},[785,199,786,199,787,788,789,790,791,199,792,199,793,199,794,795,796,797,798,799,796,800,199,801,199,794,802,800,199,803,804,805,199,806,199,807,199,808,809,810,811,812,813,814,815,816,199,817,818,819,820,199,821,199,822,199,794,504,800,199,823,199,794,824,800,199,825,826,199,827,199,828,829,199,830,831,800,199,832,199,794,833,800,199,834,835,199,836,199,837,838,839,840,841,199,830,842,800,199,843,844,199,845,846,847,199,794,848,849,850,851,852,800,199,853,854,199,855,199,856,199,794,857,858,859,800,199,860,199,794,861,800,199,862,199,794,863,864,800,199,865,866,199,867,199,868,869,199,870,199,871,872,873,874,199,875],[2364],{"_779":780,"_781":879,"_417":2365,"_784":59},[881,882,199,883,884,885,886,887,888,199,889,890,891,892,199,893,894,895,896,897,898,899,900,901,199,902,903,904,905,906,907,908,909,910,911,912,913,914,915,899,916,917,918,900,901,199,919,920,921,922,923,924,925,926,927,928,929,930,931,932,933,934,921,922,923,935,933,936,937,938,939,940,901,199,941,942,943,944,945,946,947,948,949,950,951,952,900,901,199,953,954,901,199,955,956,957,958,959,960,899,900,961,901,199,962,963,964,946,965,966,947,967,968,901,199,969,970,971,972,973,974,199,975,976,977,978,900,979,980,900,199,981,982,983,984,900,199,985,940,901,199,986,987,988,989,901,199,990,991,992,993,994,901,199,995,996,997,998,999,199,1000,1001,1002,900,1003,1004,1005,1006,1007,1008,899,1009,940,901,199,1010,1011,1012,1013,1014,1015,1016,1017,1018,1019,1020,1021,1022,1023,199,1024,1025,1026,1027,899,1028,1029,1030,899,900,940,901,199,1031,1032,1033,1034,1035,1036,1037,1038,1039,1040,1041,901,199,1042,1043,1044,1045,950,951,1046,1047,1048,1049,900,901,199,1050,1051,1052,900,1053,901,199,1054,1011,1055,1056,1057,1014,1058,1059,1060,1061,199,1062,1063,1064,1065,900,1066,1067,900,199,1068,1069,1070,1071,199,1072,1073,1074,899,1075,900,199,1076,1077,1078,1079,1080,1081,1082,914,1083,899,1084,1085,899,1086,1087,1088,1089,1090,1091,1092,1093,1094,1095,1096,1097,1098,1090,1099,1100,1090,914,1101,1102,899,1103,1104,1105,914,899,900,199,1072,1106,1107,899,1108,1109,1110,1111,899,900,199,1112,1113,1114,1115,1116,1117,1118,899,1119,1120,899,900,199,1121,940,901,199,1122,1123,901,199,1124,1125,1126,1127,1128,1129,1130,914,1131,1132,1133,1134,911,1135,1136,914,899,900,1137,901,199,1138,1125,1126,1127,1139,1140,1141,914,1142,1132,1133,1143,1144,1145,1146,911,1135,1147,914,899,900,1137,901,199,1148,1011,1149,1150,1057,1014,1151,1152,1153,899,1154,1155,1156,914,1157,1158,899,900,940,901,199,1159,1126,1127,1160,1161,1162,1163,1164,1165,899,900,940,901,199,1166,1167,1168,1169,1170,1171,1172,1173,1174,1175,1176,1177,1178,1179,1180,1181,1182,1183,1184,1164,1185,899,1186,1187,1185,899,1188,1189,1109,1190,1191,1111,899,1192,1193,1109,1194,1195,1196,1111,899,1197,1198,1199,1109,1200,1191,1111,899,900,940,901,199,1201,1202,1203,1204,1205,1206,1207,1208,1209,1210,914,1211,1212,1213,1214,1098,1090,1215,914,899,900,1216,901,199,1217,1218,1219,1220,1221,1222,1177,1178,1223,1224,1225,899,1180,900,1226,901,199,1227,1228,1229,1230,901,199,1231,1232,1229,1230,901,199,1233,1234,1235,1236,1237,901,199,1238,1239,1240,1161,1241,1242,901,199,1243,1244,901,199,1245,1246,1247,1248,900,1249,1250,1251,1235,1252,1253,901,199,1254,1255,901,199,1256,1257,901,199,1258,1259,1260,1261,1262,899,950,1263,1137,901,199,1264,1259,1265,1266,1267,1268,1269,899,900,1270,1137,901,199,1271,1272,1273,1267,1268,1274,1275,1276,899,900,940,901,199,1277,1278,901,199,1279,1280,1281,1282,1283,899,1284,1285,899,900,901,199,990,1286,1287,1288,1289,901,199,990,1290,1287,1288,1291,1292,1293,1294,901,199,1295,1296,1297,1298,1299,199,1300,199,1301,1302,1303,900,199,1301,1304,1305,1306,1307,1308,1309,1310,1311,1312,1313,1314,1315,1316,1317,1041,1318,199,1319,1320,1321,1322,1323,1324,1325,199,1326,900,199,1301,1327,1328,1306,1307,1309,1329,1330,1041,1331,1309,1310,1311,1312,1313,1332,1315,1316,1317,1041,1318,1333,1309,1334,1335,1336,1337,1041,1338,199,1319,1339,1340,1322,1341,1324,1325,199,1326,900,199,1301,1342,1343,1306,1333,1307,1344,1308,1309,1310,1311,1312,1313,1332,1315,1316,1345,1041,1318,199,1346,1320,1347,1322,1348,1324,1325,199,1326,900,199,1301,1349,1350,1306,1333,1307,1344,1308,1309,1310,1311,1312,1313,1351,1315,1316,1352,1041,1318,199,1346,1353,199,1326,900,199,1301,1354,1355,1306,1333,1307,1344,1308,1309,1310,1311,1312,1313,1356,1315,1316,1357,1041,1318,199,1346,1358,1359,1322,1360,1324,1325,199,1326,900,199,1301,1361,1362,1363,1364,1365,1366,1367,199,1368,1322,1369,1324,1325,199,1326,1370,1371,899,900,199,1301,1372,1373,1374,1375,1376,900,199,1301,1377,1378,1374,1379,1380,900,199,1301,1381,1382,1383,1384,1385,1386,1387,1388,1389,1390,1391,1392,1393,1394,1395,1396,1397,1398,1399,1400,1401,899,1322,1402,1403,1325,1322,1404,1405,1325,900,199,1301,1406,1382,1383,1384,1407,1408,1385,1388,1409,1410,1411,1412,1413,1414,1415,1416,1417,1397,1398,1399,1418,1401,899,1322,1419,1420,1325,1421,1422,1423,1424,1425,1426,1322,1427,1428,1325,1322,1429,1430,1431,1432,1325,900,199,1301,1433,1382,1383,1384,1407,1408,1322,1434,1435,1325,1436,1437,1438,1439,1440,1322,1441,1442,1443,1325,900,199,1301,1444,1382,1407,1408,1322,1445,1446,1325,900,199,1301,1447,1382,1383,1384,1448,1449,1438,1450,1451,1452,1453,1322,1454,1455,1325,900,199,1301,1456,1382,1457,1458,1407,1408,1385,1459,1460,1461,1462,1463,1464,1465,1392,1466,1467,1468,1469,1397,1398,1399,1470,1401,899,1322,1471,1472,1325,1322,1473,1474,1325,900,199,1301,1475,1382,1457,1458,1407,1408,1322,1476,1477,1325,1478,1479,1438,1480,1481,1322,1482,1483,1484,1325,1485,1486,1438,1487,1488,1322,1489,1490,1491,1325,1492,1493,1438,1494,1495,1322,1496,1497,1498,1499,1325,1500,1501,1438,1502,1322,1503,1504,1505,1506,1507,1325,900,199,1301,1508,1382,1457,1458,1492,1493,1438,1494,1495,1509,1510,1511,1512,1513,1514,1397,1398,1515,1516,1401,899,900,199,1301,1517,1382,1457,1458,1518,1519,1520,1521,1522,1523,1322,1524,1525,1325,900,199,1301,1526,1382,1457,1458,1322,1527,1528,1325,900,199,1301,1529,1382,1457,1458,1500,1501,1438,1502,1322,1530,1531,1532,1325,900,199,1301,1533,1382,1407,1408,1385,1534,1535,1536,1537,1538,1539,1397,1398,1540,1541,1401,899,900,199,1301,1542,1382,1407,1408,1509,1543,1544,1545,1546,1547,1548,1549,1550,1551,1552,1414,1397,1398,1553,1554,1401,899,900,199,1301,1555,1382,1407,1408,1509,1556,1557,1558,1559,1560,1561,1562,1563,1564,1565,1566,1397,1398,1553,1567,1401,899,900,199,1301,1568,1382,1407,1408,1509,1569,1570,1571,1572,1573,1574,1575,1576,1577,1578,1579,1397,1398,1553,1580,1401,899,900,199,1301,1581,1382,1407,1408,1509,1582,1583,1584,1572,1585,1586,1587,1588,1589,1590,1397,1398,1553,1591,1401,899,900,199,1301,1592,1382,1407,1408,1509,1593,1594,1595,1596,1597,1598,1599,1600,1601,1602,1603,1604,1605,1606,1607,1588,1608,1590,1397,1398,1553,1609,1401,899,900,199,1301,1610,1382,1611,1407,1408,1612,1613,1614,1615,1616,1397,1398,1617,1618,1401,1398,1619,1620,1401,1398,1621,1622,1401,899,900,199,1301,1623,1382,1407,1408,1509,1624,1625,1626,1627,1628,1629,1630,1631,1632,1578,1579,1397,1398,1553,1633,1401,899,900,199,1301,1634,1382,1635,1636,1385,1637,1638,1639,1640,1641,1642,1643,1644,1645,1646,1647,1648,1649,1397,1650,899,900,199,1301,1651,1382,1635,1636,1652,1653,1654,1655,1656,1657,1397,1398,1658,1659,1401,899,900,199,1301,1660,1382,1635,1636,1661,1662,199,1663,1664,1665,1666,1667,1668,1669,1670,1671,1672,1673,1090,1674,1675,1676,1677,1678,1679,1680,1681,1682,1683,1684,1685,1686,1687,1688,1689,1685,1686,1690,1691,1692,1693,1694,1695,1696,1697,1698,1699,1700,1701,1702,1698,1090,1703,914,899,199,1704,900,199,1705,1706,1707,1708,900,199,1705,1709,1710,1711,1712,900,199,1713,1714,1715,1716,900,199,1717,1718,1719,1720,1721,914,899,900,199,1722,1723,1724,1725,1726,1727,1178,1728,1729,1730,1731,1732,1090,1210,914,1733,1734,914,1735,1736,1737,1738,1737,1739,1740,1210,911,1741,1742,1210,914,1743,1744,1745,914,899,1322,1746,1747,1325,1748,900,199,1749,1750,1751,1752,1753,1754,1206,1207,1755,1210,914,1756,1757,911,1758,1759,1760,1761,1762,1763,1764,1090,1765,1766,1090,1767,1768,1090,1769,914,899,1770,1771,1772,1773,1774,899,900,199,1775,1776,1777,1778,1779,1780,900,901],[2367],{"_779":780,"_781":1784,"_417":2368,"_784":59},[1786,199,1787,1788,1789,1790,1791,1792,1793,1794,1795,1796,199,1797,1798,1799,199,1800,1801,1802,199,1803,1804,1805,1806,1807,1808,1809,1810,1811,1812,1813,199,1814,1815,1816,1817,1818,1819,1820,1821,199,1822,199,1823,1824,1825,1826,199,1827,1828,1829,1830,199,1831,1832,1833,1829,1830,199,1834,1835,1829,1830,199,1836,1837,1838,199,1839,1840,1829,1830,199,1841,1842,1843,199,1844,1845,1829,1830,199,1846,1847,1848,1849,1850,1851,1852,1853,1854,1855,1856,1857,199,1858,1816,1817,1819,1820,1821,199,1859,1860,1861,199,1862,1863,1864,1830,199,1865,1866,1867,1868,1869,1870,199,1871,1872,1830,199,1873,199,1874,1816,1817,1819,1820,1821,199,1875,1876,199,1877,1878,1864,1830,199,1879,1880,1881,1882],[2370],{"_779":780,"_781":1886,"_417":2371,"_784":59},[1888,199,1787,1889,1890,1891,1892,199,1797,1893,199,1800,1894,1802,199,1803,1895,1896,1806,1897,1898,1899,1900,1901,1902,1903,1904,1905,1808,1809,1810,1906,1811,199,1907,1908,1816,1817,1909,1819,1820,1821,199,1910,1911,1912,199,1913,1914,1915,1916,1917,1918,199,1919,1920,1921,1864,1830,199,1922,1923,1829,1830,199,1924,1925,1926,199,1927,1928,1829,1830,199,1929,1825,199,1834,1835,1829,1830,199,1846,1930,1847,1931,1932,1857,199,1933,1934,1935,1806,1936,1898,1937,1938,1808,1809,1810,1939,1811,1812,199,1940,1941,1816,1817,1942,1943,1819,1820,1821,199,1944,1945,1946,1947,199,1836,1837,1838,199,1839,1840,1829,1830,199,1843,199,1844,1845,1829,1830,199,1948,1949,1950,199,1951,1952,1953,1856,199,1954,1955,1864,1830,199,1956,1957,1958,199,1959,1960,1961,1962,1963,1806,1936,1898,1964,1808,1965,1816,1817,1966,1942,1819,1820,1821,199,1967],[2373,2374,2375,2376,2377,2378,2379,2380,2381,2382,2383],{"_754":46,"_46":1995},{"_754":1981,"_161":1883,"_779":1993,"_781":1994},{"_754":46,"_46":1992},{"_754":1981,"_161":1883,"_779":1991,"_781":1886},{"_754":46,"_46":1990},{"_754":1981,"_161":1781,"_779":1988,"_781":1989},{"_754":46,"_46":1987},{"_754":1981,"_161":876,"_779":1985,"_781":1986},{"_754":46,"_46":1984},{"_754":1981,"_161":773,"_779":1982,"_781":1983},{"_754":46,"_46":1980},[2386,2387,2388,2389,2390,2391,2392,2393,2394,2395,2396,2397,2398,2399,2400,2401,2402,2403,2404,2405,2406,2407,2408,2409,2410,2411],{"_2005":2006,"_263":196,"_2007":305,"_274":-5,"_2008":257,"_2009":-5,"_2010":-5,"_2011":2012,"_2013":2014,"_2015":-5,"_2016":-5,"_2017":2018,"_2019":15,"_2020":59,"_2021":54,"_2022":15},{"_92":423,"_96":325,"_417":2412},{"_312":313,"_314":315,"_2085":319,"_2086":129,"_321":-5,"_92":2087},{"_92":2049,"_314":2084,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2083,"_161":1883,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2082,"_161":1781,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2080,"_161":876,"_2051":2054,"_2052":2081},{"_92":2049,"_314":2078,"_161":876,"_2051":2054,"_2052":2079},{"_92":2049,"_314":2077,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2076,"_161":1883,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2075,"_161":1883,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2074,"_161":773,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2073,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2072,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2070,"_161":1883,"_2051":2054,"_2052":2071},{"_92":2049,"_314":2068,"_161":876,"_2051":2054,"_2052":2069},{"_92":2049,"_314":2066,"_161":876,"_2051":2054,"_2052":2067},{"_92":2049,"_314":2065,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2064,"_161":1883,"_2051":2054,"_2052":1886},{"_92":2049,"_314":2063,"_161":773,"_2051":2054,"_2052":-5},{"_92":2049,"_314":2061,"_161":1781,"_2051":2054,"_2052":2062},{"_92":2049,"_314":2050,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2060,"_161":-5,"_2051":-5,"_2052":-5},{"_92":2049,"_314":2058,"_161":1781,"_2051":2054,"_2052":2059},{"_92":2049,"_314":2056,"_161":1781,"_2051":2054,"_2052":2057},{"_92":2049,"_314":2053,"_161":1883,"_2051":2054,"_2052":2055},{"_92":2049,"_314":2050,"_161":-5,"_2051":-5,"_2052":-5},[2413],{"_754":46,"_46":2090},"task_e_6a3d80e56658832a8f631f6ff783485e",1782415589.400037,"GitHub Mention: Prepare v0.5.0-alpha.1 release","has_generated_title","has_unread_turn","denormalized_metadata",{"_2445":32,"_2446":2447,"_2448":-5,"_2449":-5,"_2440":2450,"_2451":-5,"_2452":-5,"_2453":-5,"_2454":-5},"task_status_display",{"_2433":2434,"_2435":196,"_130":127,"_2436":-5,"_2437":2438},"creator_workspace","external_pull_requests",[2426],{"_42":2427,"_2428":83,"_2429":2430,"_2431":129},"github-1272888914-43","assistant_turn_id","pull_request",{"_304":305,"_295":306,"_307":308,"_309":15,"_310":59,"_311":15,"_312":313,"_314":315,"_316":267,"_317":127,"_318":319,"_320":129,"_321":322,"_323":-5,"_324":-5,"_325":2432,"_327":328,"_329":330,"_331":332,"_333":334},"codex_updated_sha",{"_289":290,"_181":290,"_335":-5,"_293":294,"_42":291},"latest_turn_status_display",{"_2439":83,"_112":113,"_2440":-5,"_94":2441,"_2442":-5,"_2443":-5,"_2444":2438,"_114":-5},"environment_label","fix_task_id","initial_intent","pr","turn_id","diff_stats",[],"image_asset_pointer_citations","issue_counts","intent","num_follow_ups","repo_name_map",{},"last_user_turn_created_at","last_turn_status",{"_2455":-5,"_2456":-5,"_2457":-5},"last_pushed_turn_id","start_branch_name","pushed_branch_name","cached_pull_request_data","files_modified","lines_added","lines_removed","dd",{"_2470":2471,"_2472":2473},"disablePrefetch","shouldPrefetchAccount","shouldPrefetchUser","shouldPrefetchSystemHints","promoteCss","disableSSR","stripModulepreloadImports","paidCampaignAppRedirect","statsigGateEvaluationsPromise",["P",2469],"traceId","10222629548541605806","traceTime",1786140659964]